fix(deps): update keycloakclientversion to v26 (major) #603
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=80&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
from
dd298a3 to
78aedce
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
2 times, most recently
from
9b80c0c to
5c50158
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
2 times, most recently
from
1ed126e to
9c9e86a
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
from
9c9e86a to
e870aa0
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
from
e870aa0 to
696999c
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
from
696999c to
3af2c42
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
from
3af2c42 to
944525b
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
2 times, most recently
from
fd43d1c to
cd5ca80
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
3 times, most recently
from
d456c61 to
39fa3cb
Compare
renovate
bot
force-pushed
the
renovate/major-keycloakclientversion
branch
from
39fa3cb to
e2d8876
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
25.0.6->26.4.025.0.6->26.0.7Release Notes
keycloak/keycloak (org.keycloak:keycloak-core)
v26.4.0Compare Source
Highlights
This release features new capabilities focused on security enhancements, deeper integration, and improved server administration. The highlights of this release are:
Passkeys for seamless, passwordless authentication of users.
Federated Client Authentication to use SPIFFE or Kubernetes service account tokens for client authentication.
Simplified deployments across multiple availability zones to boost availability.
FAPI 2 Final: Keycloak now supports the final specifications of FAPI 2.0 Security Profile and FAPI 2.0 Message Signing.
DPoP: The OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) is now fully supported. Improvements include the ability to bind only refresh tokens for public clients, and securing all Keycloak endpoints with DPoP tokens.
Read on to learn more about each new feature. If you are upgrading from a previous release, review also the changes listed in the upgrading guide.
Security and Standards
Passkeys integration (supported)
Passkeys are now seamlessly integrated in the Keycloak login forms using both conditional and modal UIs. To activate the integration in the realm, go to Authentication, Policies, Webauthn Passwordless Policy and switch Enable Passkeys to enabled.
For more information, see Passkeys.
FAPI 2 Final (supported)
Keycloak has support for the latest versions of FAPI 2 specifications. Specifications FAPI 2.0 Security Profile and FAPI 2.0 Message Signing are already promoted to Final and Keycloak supports them. Keycloak client policies support the final versions and corresponding client profiles for FAPI 2 are passing the FAPI conformance test suite.
Apart from some very minor polishing of existing policies, Keycloak has new client profiles (
fapi-2-dpop-security-profileandfapi-2-dpop-message-signing) for the clients that use DPoP and are intended to be FAPI 2 compliant.Thank you to Takashi Norimatsu for contributing this.
For more details, see the Securing applications Guides.
DPoP (supported)
Keycloak has support for OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP), which was a preview feature since Keycloak 23. Also, the supported version includes some improvements and minor capabilities of the DPoP feature such as the following:
Possibility to make only refresh tokens of a public client to be DPoP bound and omit the binding of an access token.
All Keycloak endpoints that are secured by bearer token can now handle DPoP tokens. This includes, for example, the Admin REST API and Account REST API.
Possibility to require the
dpop_jktparameter in the OIDC authentication request.Thanks to Takashi Norimatsu and Dmitry Telegin for their contributions to the DPoP feature.
For more information, see the DPoP section in the documentation.
FIPS 140-2 mode now supports EdDSA
With the upgrade to Bouncy Castle 2.1.x, the algorithm EdDSA can now be used.
Listing supported OAuth standards on one page
A new guide lists all implemented OpenID Connect related specifications. Thank you to Takashi Norimatsu for contributing this.
Integration
Federated client authentication (preview)
Identity providers are now able to federate client authentication. This allows clients to authenticate with SPIFFE JWT SVIDs, Kubernetes service account tokens, or tokens issued by an OpenID Connect identity provider.
This feature is currently preview, and expected to become supported in 26.5.
Automatic certificate management for SAML clients
The SAML clients can now be configured to automatically download the signing and encrypting certificates from the SP entity metadata descriptor endpoint. In order to use this new feature, in the client Settings tab, section Signature and Encryption, configure the Metadata descriptor URL option (the URL where the SP metadata information with the certificates is published) and activate Use metadata descriptor URL. The certificates will be automatically downloaded and cached in the
public-key-storageSPI from that URL. This also allows for seamless rotation of certificates.For more information, see Creating a SAML client in the Server Administration Guide.
Serving as an authorization server in MCP
MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems. Using MCP, AI applications can connect to data sources, tools and workflows enabling them to access key information and perform tasks.
To comply with MCP specification, this version provides its OAuth 2.0 Server Metadata via a well-known URI whose format complies with RFC 8414 OAuth 2.0 Authorization Server Metadata specification. Therefore, Keycloak users can now use Keycloak as an authorization server for MCP.
The latest MCP specification 2025-06-18 additionally requires support for resource indicators which are currently not implemented in Keycloak.
Administration
Update Email Workflow (supported)
Users can now update their email addresses in a more secure and consistent flow. Accounts are forced to both re-authenticate and verify their emails before any account updates.
For more information, see Update Email Workflow.
Optional email domain for organizations
In earlier versions, each organization required at least one email domain, which was a limitation for some scenarios. Starting with this release, an email domain is optional. Thank you to Alexis Rico for contributing this.
When no domain is specified, organization members will not be validated against domain restrictions during authentication and profile validation.
Hiding identity providers from the Account Console
You can now control which identity providers appear in the Account Console based on different options using the
Show in Account consolesetting. You can choose to show only those linked with a user or hide them completely.For more information, see General configuration.
Enforce recovery codes setup after setting up OTP
If you have enabled OTPs and recovery codes as a second factor for authentication, you can configure the OTP required action to ask users to set up recovery codes once they set up an OTP. Thank you to Niko Köbler for contributing this.
New conditional authenticator
The Conditional - credential is a new authenticator that checks if a specific credential type has been used (or not used) during the authentication process. This condition is related to the Passkeys feature. It is added by Keycloak to the default browser flow to skip 2FA in case a passkey was used to log in as the primary credential.
For more information about conditional flows, see Conditions in conditional flows.
Translations managed by Weblate
The Keycloak distribution now includes 35 community translations, with Kazakh, Azerbaijani and Slovenian added in this release. Community volunteers now maintain some of the translations in Weblate to keep them up to date.
If you want to volunteer to maintain an existing or a new translation via Weblate, you can find the necessary steps in the translation guidelines.
Configuring and Running
Enhancements for single-cluster and multi-cluster setups
This release renamed multi-site to multi-cluster. The updated documentation describes how Keycloak clusters can be optionally distributed across multiple availability-zones within a region for increased availability. The Keycloak Operator now deploys Keycloak across multiple availability zones within a Kubernetes cluster by default. Keycloak also detects split-brains within a cluster.
This change should provide better availability for users who are running Keycloak in Kubernetes clusters that span multiple availability zones.
Support for additional databases and versions
With this release, we added support for the following new database vendors:
EnterpriseDB (EDB) Advanced 17.6
Azure SQL Database and Azure SQL Managed Instance
Where the previous documentation stated only tested database version, it now states all the supported database versions as well.
Expose management interface via HTTP
Previous versions exposed the management endpoint only via HTTPS when the main interface was using HTTPS.
Set the new option
http-management-schemetohttpto have the management interface use HTTP rather than inheriting the HTTPS settings of the main interface. This allows monitoring those endpoints in environments where no TLS client is available.Expose health endpoints on the main HTTP(S) port
With
health-enabledset to true, you may set thehttp-management-health-enabledtofalseto indicate that health endpoints should be exposed on the main HTTP(s) port instead of the management port. When this option isfalseyou should block unwanted external traffic to/healthat your proxy.This allows using the health endpoints in environments where the load balancer might need access to those ports to direct traffic to the correct nodes.
Specify a
tlsSecreton the Keycloak CRingressspecTo support basic TLS termination (edge) deployments by the operator, you may now set the Keycloak CR
spec.ingress.tlsSecretfield to a TLS Secret name in the namespace.Additional datasources configuration (supported)
Some Keycloak use cases like User Federation might require connecting to additional databases. This was possible only through specifying unsupported raw Quarkus properties in previous Keycloak versions. In this release, there are now dedicated server options for additional datasources. This allows users to leverage additional databases in their extensions in a supported and user-friendly way.
Read more about it in the Configure multiple datasources guide.
Observability
Operator creates a ServiceMonitor automatically
The Operator now provisions a
ServiceMonitorfor the management endpoint if metrics are enabled and themonitoring.coreos.com/v1:ServiceMonitorCustom Resource Definition is present on the Kubernetes cluster. The specification of theServiceMonitortakes into account the various management endpoint configurations, to ensure that metrics can be scraped without any additional configuration. If you do not want aServiceMonitorto be created, you can disable this by settingspec.serviceMonitor.enabled: false. For more details, see the Operator Guide.HTTP access logging of incoming HTTP requests
Keycloak supports HTTP access logging to record details of incoming HTTP requests. While access logs are often used for debugging and traffic analysis, they are also important for security auditing and compliance monitoring.
For more information, see Configuring logging.
Showing context information in log messages (preview)
You can now add context information via the mapped diagnostic context (MDC) to each log message like the realm or the client that initiated the request. This helps you to track down a warning or error message in the log to a specific caller or environment Thank you to Björn Eickvonder for contributing this.
For more details on this opt-in feature, see Configuring logging.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
New features
account/apiauthenticationauthentication/webauthntest-frameworktest-frameworkEnhancements
account/uiidentity-brokeringsamldist/quarkusoperatoradmin/apidist/quarkusoidcdist/quarkuscoredocsoidccoreoperatoroidcoperatordocsoid4vccoreinfinispanadmin/client-javadocsaccount/uiinfinispandist/quarkusadmin/uiaccount/uiauthentication/webauthntoken-exchange/federatedtest-frameworkcoretoken-exchange/federatedsamlinfinispanoperatoroidcoidcoidcdist/quarkusoidcdist/quarkusdist/quarkusdist/quarkuscoretranslationsdist/quarkusinfinispanauthentication/webauthnstorageoidcoidcdist/quarkusdist/quarkusidentity-brokeringauthentication/webauthndocsauthentication/webauthnlogin/uidist/quarkustranslationsoidctranslationscoreoidcoidcoidclogin/uicoreoidcstoragedist/quarkusdocsorganizationsoidcinfinispanoidccioidcoidccoreoid4vcworkflowsoid4vccidocsBugs
corecoredist/quarkusauthenticationcoreadmin/apicoreoperatorauthenticationcicoredist/quarkusadmin/client-javaciciorganizationscoreadmin/apistorageauthenticationdist/quarkusauthenticationaccount/uiadmin/uiauthenticationaccount/apiinfinispanciinfinispanaccount/apiaccount/uiadmin/uidist/quarkusoidcoperatordist/quarkusdocsoperatorConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.