Releases: keycloak/keycloak
nightly
Remove outdated protostream.version comment Closes #34931 Signed-off-by: Ryan Emerson <[email protected]>
26.0.6
Highlights
Admin events might include now additional details about the context when the event is fired
In this release, admin events might hold additional details about the context when the event is fired. When upgrading you should
expect the database schema being updated to add a new column DETAILS_JSON to the ADMIN_EVENT_ENTITY table.
Updates to documentation of X.509 client certificate lookup via proxy
Potential vulnerable configurations have been identified in the X.509 client certificate lookup when using a reverse proxy. Additional configuration steps might be required depending on your current configuration. Make sure to review the updated reverse proxy guide if you have configured the client certificate lookup via a proxy header.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #34315 Update the Keycloak CPU and Memory sizing guide to reflect the new ec2 workder nodes
- #34386 Some dynamic imported functions are also statically imported making bundling them in-efficient
- #34570 Make documentation more clear that keycloak javascript adapter and node.js adapter are OIDC
docs - #34855 Add conditional text to Installation Locations
- #34873 Update Leveraging JaKarta EE in Server Development guide
- #34887 Apply QE edits to High Availability guide
Bugs
- #609 Workflow failure - Jakarta - SAMLServiceProviderTest.testAccessAccountManagement
- #11008 Incorrect get the members of a group imported from LDAP
ldap - #17593 Incorrect ldap-group-mapper chosen to sync changes to ActiveDirectory when several mappers with varying group paths used
ldap - #19652 Members are inhereted from LDAP group with the same name
ldap - #23732 JavascriptAdapterTest errors when running with strict cookies on Firefox
ci - #27856 Social login - Stack Overflow test fails
ci - #31456 Enabling/Disabling user does not work with Microsoft AD LDAP via Admin API/UI
ldap - #32786 Organization Domain not marked as a required field in the Admin UI
admin/ui - #33531 Previously entered translations should persist in the translation dialog for the attribute groups
admin/ui - #34013 Add More Info to Organization Events
organizations - #34065 Users without `view-realm` can't see user lockout state in Admin UI
admin/ui - #34201 OIDC IdP Unable to validate signatures using validatingPublicKey certificate
admin/ui - #34335 NPE in Organization(s)Resource when using Quarkus Rest Client
admin/api - #34401 Incorrect Content-Type Expectation for POST /admin/realms/{realm}/organizations/{id}/members in Keycloak API
admin/api - #34465 Missing help icons in Webauthn Policy and Webauthn Passwordless Policy missing in admin ui
admin/ui - #34519 Clicking on link to Keycloak documentation from Keycloak admin UI does nothing instead of opening documentation
admin/ui - #34549 Quarkus dev mode does not work
dist/quarkus - #34572 Text in "Choose a policy type" is not wrapping
admin/ui - #34603 NPE in InfinispanOrganizationProvider if userCache is disabled
infinispan - #34624 Securing apps guide breaks downstream
docs - #34634 Missing downstream explicit name for anchors
docs - #34644 KC_CACHE_EMBEDDED_MTLS_ENABLED is ignored
infinispan - #34671 `ClientConnection.getRemoteAddr` can return a hostname when behind a reverse proxy
core - #34687 New credential templates broken in KC26
login/ui - #34905 [Keycloak CI] Outdated surefire artifacts names - Quarkus IT and UT
ci - #35213 CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process
- #35214 CVE-2024-10270 Potential Denial of Service
- #35215 CVE-2024-10492 Keycloak path trasversal
- #35216 CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability
- #35217 CVE-2024-10039 Bypassing mTLS validation
26.0.5
Highlights
LDAP users are created as enabled by default when using Microsoft Active Directory
If you are using Microsoft AD and creating users through the administrative interfaces, the user will created as enabled by default.
In previous versions, it was only possible to update the user status after setting a (non-temporary) password to the user. This behavior was not consistent with other built-in user storages as well as not consistent with others LDAP vendors supported by the LDAP provider.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Bugs
- #31415 Selection list does not close after outside click
admin/ui - #33607 Fix v2 login layout
login/ui - #33618 No message for `policyGroupsHelp`
admin/ui - #33640 Customizable footer (Keycloak 26) not displaying in keycloak.v2 login theme
login/ui - #34301 Remove inaccurate statement about master realm imports
docs - #34450 [26.0.2] Migration from 25.0.1 Identity Provider Errors
identity-brokering - #34467 Do not rely on the `pwdLastSet` attribute when updating AD entries
ldap
26.0.4
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #34284 Keycloak-admin-client should work with the future versions of Keycloak server
admin/client-java - #34382 Make the organization chapter of Server Admin guide available on downstream
Bugs
- #14562 Broken Promise implementation for AuthZ JS
adapter/javascript - #25917 Allow increasing wait time on each failure after the max number of failures is reached
authentication - #33627 ClassNotFoundException OracleXADataSource/OracleDataSource using IDELauncher with Keycloak 26.0.0
dist/quarkus - #33731 Client Scope updates are not replicated on a distributed keycloak setup in kubernetes
admin/api - #33798 CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication
dist/quarkus - #33987 keycloak.v2 registration: Password policy validation error "errorList is null"
login/ui - #34042 LDAP Pagination not working for role membership in GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE strategy
ldap - #34050 Listing federated LDAP users is very slow with import enabled
ldap - #34093 java.util.ConcurrentModificationException when process user sessions update
infinispan - #34412 LDAP: searching users with import disabled is slower since fix for 34050
ldap
26.0.2
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #32110 [Documentation] - Configuring trusted certificates - Fully specify truststore path
dist/quarkus
Bugs
- #15635 oidc - JavaScript-Adapter LocalStorage#clearExpired does not clear all possible items
adapter/javascript - #19101 Uncaught (in promise): QuotaExceededError
adapter/javascript - #20287 When using `oidcProvider` config url (.well-known) it's not possible to use `silentCheckSsoRedirectUri`
adapter/javascript - #28978 some GUI validation check missing
admin/ui - #30832 Organization API not available from OpenAPI documentation
admin/api - #31724 Logout not working after removing Identity Provider of user
identity-brokering - #33072 Passkeys: Infinite (re-)loading loop on browsers with WebAuthn Conditional UI disabled
authentication/webauthn - #33844 Wrong documentation link in keycloak-js readme
docs - #33902 Not persisted config settings prevent server start
dist/quarkus - #33948 [PERF] OpenTelemetry is initialized even when disabled
- #33968 Not possible to close dialog boxes when clicking buttons or the close icon
admin/ui - #33991 Doc CI - broken links error
docs - #34009 grammatical error in "Managing Organizations" documentation
docs - #34015 Home URL for security-admin-console is broken
admin/ui - #34028 Custom keycloak login theme styles.css return error 404
login/ui - #34049 Org Invite: `linkExpiration` template variable represents 54 years in minutes
organizations - #34063 Respect the locale set to a user when redering verify email pages
user-profile - #34069 Do not show domain match message in the identity-first login when no login hint is provided
organizations - #34075 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled
ci - #34095 Keycloak 26.0.0/26.0.1 Import Issue: Multiple Realms Not Imported, Duplicated Realm Imported Instead
import-export - #34151 JS password validation doesn't work as intended with uppercase and lowercase minimum requirements
login/ui - #34155 cli options starting or ending with ; or containing ;; mangle the cli handling
dist/quarkus - #34224 Deleting a user leads to ISPN marshalling exception
26.0.1
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #32152 Clarify the behaviour of multiple Operator versions installed in the same cluster
operator - #33275 Better logging when error happens during transaction commit
storage
Bugs
- #8935 keycloak.js example from the documentation leads to error path
adapter/javascript - #19358 Issue with concurrent user & group delete, unable to cleanup resource server user-policy & group-policy
authorization-services - #31848 Repeated email verifications while logging in through IDP caused by email case sensitivity
authentication - #32266 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and user already exists
ldap - #32617 Nightly Cypress tests for the Admin Console are failing on Firefox
admin/ui - #32844 Login V2: Missing "dir" attributes
login/ui - #32847 Admin UI defaults to master realm even without permissions to it
admin/ui - #32962 Possible issue with unavailable CryptoIntegration when using keycloak-authz-client with private_key_jwt and ECDSA algorithm
oidc - #33513 Can get authorization code on a non verified user with some specific kc_action (AIA)
oidc - #33539 Keycloak In Docker: ERROR: Strict hostname resolution configured but no hostname setting provided
docs - #33549 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled
ci - #33557 Unable to submit forms in Safari
account/ui - #33576 Broken links / anchors after KC26 release
docs - #33578 In imported realms, the ability to use environment variables has disappeared
import-export - #33585 Fix runaway asterisk formatting in TLS documentation
docs - #33638 Non-optimized start command gives erroneous warnings for runtime spi options
dist/quarkus - #33642 RTL not working on keycloak.v2 login template
login/ui - #33645 keycloak-js register broken: createRegisterUrl not awaited
adapter/javascript - #33699 Failure to redirect to organization IdP when the organization scope is included
organizations - #33735 Organizations section is shown in account console if organizations is not enabled for a realm.
account/ui - #33776 [Regression] 26.0.0 return empty "access: []" JWT for Docker-v2 Auth provider, resulting in "access denied"
authentication - #33777 Error when adding or removing a user from an organisation when there are 2 or more Keycloak servers in a cluster
organizations - #33780 Upgrade to 26 fails with 'ERROR: index "idx_us_sess_id_on_cl_sess" does not exist'
core - #33814 NPE when device representation cannot be parsed
authentication - #33817 NEP when Default Role is not present on CachedRealm
infinispan - #33874 [Keycloak CI] - AuroraDB IT - Error creating EC2 runner instance
- #33875 [Keycloak CI] - FIPS IT - Failed to fetch maven
- #33883 Auth not possible for auth session where user was enabled in the meantime
authentication - #33907 NPE thrown in whoami endpoint
admin/ui - #33967 password is a required field
admin/ui
26.0.0
Highlights
Organizations supported
Starting with Keycloak 26, the Organizations feature is fully supported.
Client libraries updates
Dedicated release cycle for the client libraries
From this release, some of the Keycloak client libraries will have release cycle independent of the Keycloak server release cycle. The 26.0.0 release may be the last one when the client libraries are released together with the Keycloak server. But from now on, the client libraries may be released at a different time than the Keycloak server.
The client libraries are these artifacts:
-
Java admin client - Maven artifact
org.keycloak:keycloak-admin-client -
Java authorization client - Maven artifact
org.keycloak:keycloak-authz-client -
Java policy enforcer - Maven artifact
org.keycloak:keycloak-policy-enforcer
It is possible that in the future, some more libraries will be included.
The client libraries are supported with Java 8, so it is possible to use them with the client applications deployed on the older application servers.
Compatibility of the client libraries with the server
Beginning with this release, we are testing and supporting client libraries with the same server version and a few previous major server versions.
For details about supported versions of client libraries with server versions, see the Upgrading Guide.
User sessions persisted by default
Keycloak 25 introduced the feature persistent-user-sessions. With this feature enabled all user sessions are persisted in the database as opposed to the previous behavior where only offline sessions were persisted.
In Keycloak 26, this feature is enabled by default. This means that all user sessions are persisted in the database by default.
It is possible to revert this behavior to the previous state by disabling the feature. Follow the Volatile user sessions section in Configuring distributed caches guide for more details.
For information on how to upgrade, see the Upgrading Guide.
New default login theme
There is now a new version (v2) of the keycloak login theme, which provides an improved look and feel, including support for switching automatically to a dark theme based on user preferences.
The previous version (v1) is now deprecated, and will be removed in a future release.
For all new realms, keycloak.v2 will be the default login theme. Also, any existing realm that never explicitly set a login theme will be switched to keycloak.v2.
Highly available multi-site deployments
Keycloak 26 introduces significant improvements to the recommended HA multi-site architecture, most notably:
-
Keycloak deployments are now able to handle user requests simultaneously in both sites.
-
Active monitoring of the connectivity between the sites is now required to update the replication between the sites in case of a failure.
-
The loadbalancer blueprint has been updated to use the AWS Global Accelerator as this avoids prolonged fail-over times caused by DNS caching by clients.
-
Persistent user sessions are now a requirement of the architecture. Consequently, user sessions will be kept on Keycloak or Infinispan upgrades.
For information on how to migrate, see the Upgrading Guide.
Admin Bootstrapping and Recovery
In the past, regaining access to a Keycloak instance when all admin users were locked out was a challenging and complex process. Recognizing these challenges and aiming to significantly enhance the user experience, Keycloak now offers several straightforward methods to bootstrap a temporary admin account and recover lost admin access.
It is now possible to run the start or start-dev commands with specific options to create a temporary admin account. Additionally, a new dedicated command has been introduced, which allows users to regain admin access without hassle.
For detailed instructions and more information on this topic, refer to the Admin Bootstrap and Recovery guide.
OpenTelemetry Tracing preview
The underlying Quarkus support for OpenTelemetry Tracing has been exposed to Keycloak and allows obtaining application traces for better observability. It helps to find performance bottlenecks, determine the cause of application failures, trace a request through the distributed system, and much more. The support is in preview mode, and we would be happy to obtain any feedback.
For more information, see the Enabling Tracing guide.
OpenID for Verifiable Credential Issuance
The OpenID for Verifiable Credential Issuance (OID4VCI) is still an experimental feature in Keycloak, but it was greatly improved in this release. You will find significant development and discussions in the Keycloak OAuth SIG. Anyone from the Keycloak community is welcome to join.
Many thanks to all members of the OAuth SIG group for the participation on the development and discussions about this feature. Especially thanks to the Francis Pouatcha, Pascal Knüppel, Takashi Norimatsu, Ingrid Kamga, Stefan Wiedemann and Thomas Darimont
DPoP improvements
The DPoP (OAuth 2.0 Demonstrating Proof-of-Possession) preview feature has improvements. The DPoP is now supported for all grant types.
With previous releases, this feature was supported only for the authorization_code grant type. Support also exists for the DPoP token type on the UserInfo endpoint.
Many thanks to Pascal Knüppel for the contribution.
Removal of GELF logging handler
GELF support has been deprecated for a while now, and with this release it has been finally removed from Keycloak. Other log handlers are available and fully supported to be used as a replacement of GELF, for example Syslog. For details see the Logging guide.
Lightweight access tokens for Admin REST API
Lightweight access tokens can now be used on the admin REST API. The security-admin-console and admin-cli clients are now using lightweight access tokens by default, so “Always Use Lightweight Access Token” and “Full Scope Allowed” are now enabled on these two clients. However, the behavior in the admin console should effectively remain the same. Be cautious if you have made changes to these two clients and if you are using them for other purposes.
Keycloak JavaScript adapter now standalone
Keycloak JavaScript adapter is now a standalone library and is therefore no longer served statically from the Keycloak server. The goal is to de-couple the library from the Keycloak server, so that it can be refactored independently, simplifying the code and making it easier to maintain in the future. Additionally, the library is now free of third-party dependencies, which makes it more lightweight and easier to use in different environments.
For a complete breakdown of the changes consult the
25.0.6
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Bugs
- #30604 Network response was not OK.
saml - #31165 Re-enabling a temporarily locked user (brute-force) deletes all user properties and attributes
admin/ui - #32100 Remember Me with External Infinispan is not works properly
infinispan - #32578 WebAuthn Flows Broken in login.v2
login/ui - #32643 Dots are not allowed in the path in Hostname v2
dist/quarkus - #32731 KeyCloak Admin Client uses non-standard `@NoCache` annotation which is an issue for Quarkus
admin/client-java - #32799 Realm import fails when client configures default_acr values
import-export - #32870 Increased DB activity due to changes in LDAPStorageManager.searchForUserByUserAttributeStream
ldap - #33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect
- #33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
25.0.5
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Bugs
- #32084 SAML adapter IdMapperUpdaterSessionListener not executed when session ID changes
adapter/saml - #32754 CVE-2024-7341 Session fixation in the SAML adapters
adapter/saml
25.0.4
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #31963 Upgrade to Infinispan 15.0.7.Final
Bugs
- #31299 NPM library of account-ui is unusable (@keycloak/keycloak-account-ui version 25.0.1)
account/ui - #31304 Hide save / update buttons in account console for READ_ONLY federated accounts
account/ui - #31340 Hidden options shown in help all
dist/quarkus - #31386 Joining group for user doesn't list correct number of groups
admin/ui - #31466 Duplicate Key "validatingX509CertsHelp" in admin-ui messages
admin/ui - #31519 Admin API extremely slow with service account and fine-grained authorization `view-users`
admin/fine-grained-permissions - #31545 Event tables have broken aria-labels
admin/ui - #31558 MSSQL test container can't start
ci - #31598 CURL commands in build don't check the response code
ci - #31633 localization not work with user attribute display name in users add
admin/ui - #31687 "Use metadata descriptor URL" switch is always set to "On"
admin/ui - #31718 Documentation for `Delete Credential` action and related changes
authentication - #31781 Keycloak 25 SAML IdP has made Single Logout URL mandatory.
saml - #31835 Windows builds fail too often due to problems with the download of Node
ci - #31918 Network error attempting to view events without permissions
admin/ui - #31929 Network error attempting to view user registeration without permissions
admin/ui - #32059 Look around window cannot be set to 0
admin/ui - #32127 Offline session bug on 25.0.2
core - #32150 Session list doesn't handle non-existing client gracefully
core - #32178 Table names for persistent sessions upgrading guide is wrong
docs - #32180 Session list not appearing: SQL Error "The incoming request has too many parameters"
- #32195 Migration to persistent sessions fails from Keycloak version <22
storage