Keycloak 24.0.0 — Release Notes & Engineering Impact

<div> <h2>Highlights</h2> <div class="sect2"> <h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> <div class="paragraph"> <p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> </div> <div class="paragraph"> <p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and polishing were done based on the thorough testing and feedback from our awesome community.</p> </div> <div class="paragraph"> <p>The following are a few highlights of this feature;</p> </div> <div class="ulist"> <ul> <li> <p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> </li> <li> <p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> </li> <li> <p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> </li> <li> <p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a particular attribute to be a URL or number.</p> </li> <li> <p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> </li> <li> <p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client applications that are used by the user.</p> </li> <li> <p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </li> </ul> </div> <div class="paragraph"> <p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> </div> <div class="paragraph"> <p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> </div> <div class="ulist"> <ul> <li> <p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> </li> <li> <p><a href="https://github.com/alechenninger">Alec Henninger</a></p> </li> <li> <p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> </li> <li> <p><a href="https://github.com/bs-matil">Markus Till</a></p> </li> <li> <p><a href="https://github.com/sschu">Sebastian Schuster</a></p> </li> <li> <p><a href="https://github.com/antikalk">Oliver</a></p> </li> <li> <p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> </li> <li> <p><a href="https://github.com/adrhine">Andrew</a></p> </li> </ul> </div> <div class="paragraph"> <p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> </div> <div class="sect3"> <h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> <div class="paragraph"> <p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect3"> <h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> <div class="paragraph"> <p>In this release, the following templates were updated to make it possible to dynamically render attributes based on the user profile configuration set to a realm:</p> </div> <div class="ulist"> <ul> <li> <p><code>login-update-profile.ftl</code></p> </li> <li> <p><code>register.ftl</code></p> </li> <li> <p><code>update-email.ftl</code></p> </li> </ul> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect3"> <h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> <div class="paragraph"> <p>In this release, the server renders the update profile page when the user is authenticating through a broker for the first time using the <code>idp-review-user-profile.ftl</code> template.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> </div> <div class="sect2"> <h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> <div class="paragraph"> <p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> </div> <div class="paragraph"> <p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> </div> <div class="paragraph"> <p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any other OAuth 2.0 or OpenID Connect libraries.</p> </div> <div class="paragraph"> <p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> </div> <div class="sect3"> <h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> <div class="paragraph"> <p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been removed from this release.</p> </div> </div> </div> <div class="sect2"> <h3 id="_new_welcome_page">New Welcome Page</h3> <div class="paragraph"> <p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> </div> <div class="paragraph"> <p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> <div class="paragraph"> <p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> </div> <div class="paragraph"> <p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> </div> <div class="paragraph"> <p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_keycloak_js">Keycloak JS</h3> <div class="sect3"> <h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> <div class="paragraph"> <p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> </div> </div> <div class="sect3"> <h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> <div class="paragraph"> <p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> </div> </div> </div> <div class="sect2"> <h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> <div class="paragraph"> <p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> </div> <div class="paragraph"> <p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> <div class="sect3"> <h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> <div class="paragraph"> <p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> </div> <div class="paragraph"> <p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> </div> <div class="paragraph"> <p>Also, a client policy executor exists. Use it to specify if a particular client request should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> </div> <div class="paragraph"> <p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add claims that are not present in the access token into the introspection endpoint response.</p> </div> <div class="paragraph"> <p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> </div> </div> <div class="sect3"> <h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> <div class="paragraph"> <p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> </div> </div> <div class="sect3"> <h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> <div class="paragraph"> <p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as described in the OAuth2 specification. Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> </div> </div> <div class="sect3"> <h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> <div class="paragraph"> <p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> </div> </div> <div class="sect3"> <h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> <div class="paragraph"> <p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview is enabled. Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> </div> </div> <div class="sect3"> <h4 id="_supporting_eddsa">Supporting EdDSA</h4> <div class="paragraph"> <p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> </div> </div> <div class="sect3"> <h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> <div class="paragraph"> <p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> </div> </div> <div class="sect3"> <h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> <div class="paragraph"> <p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> </div> </div> <div class="sect3"> <h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> <div class="paragraph"> <p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types supported by the Keycloak OAuth 2 token endpoint. Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> </div> </div> </div> <div class="sect2"> <h3 id="_cors_improvements">CORS improvements</h3> <div class="paragraph"> <p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> </div> </div> <div class="sect2"> <h3 id="_truststore_improvements">Truststore improvements</h3> <div class="paragraph"> <p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_versioned_features">Versioned Features</h3> <div class="paragraph"> <p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> </div> <div class="paragraph"> <p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> </div> <div class="sect3"> <h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> <div class="paragraph"> <p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> </div> <div class="listingblock"> <div class="content"> <pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: truststores: mystore: secret: name: mystore-secret myotherstore: secret: name: myotherstore-secret</code></pre> </div> </div> <div class="paragraph"> <p>Currently only Secrets are supported.</p> </div> </div> <div class="sect3"> <h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> <div class="paragraph"> <p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> </div> </div> </div> <div class="sect2"> <h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> <div class="paragraph"> <p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> </div> <div class="paragraph"> <p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> </div> </div> <div class="sect2"> <h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> <div class="paragraph"> <p>A new health check endpoint available at <code>/lb-check</code> was added. The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> </div> <div class="paragraph"> <p>This endpoint is not available by default. To enable it, run Keyloak with the <code>multi-site</code> feature. For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> </div> </div> <div class="sect2"> <h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> <div class="paragraph"> <p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> </div> </div> <div class="sect2"> <h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> <div class="paragraph"> <p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> <div class="paragraph"> <p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> </div> <div class="paragraph"> <p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile configuration set to a realm.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> <div class="paragraph"> <p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. If offline session preloading is enabled, those will be loaded sequentially as well.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> <div class="paragraph"> <p>In this release, you can no longer perform actions such as email verification if the user is already authenticated and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link is bound to a different account.</p> </div> </div> <div class="sect2"> <h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> <div class="paragraph"> <p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message will be shown.</p> </div> <div class="paragraph"> <p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> </div> </div> <div class="sect2"> <h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> <div class="paragraph"> <p>The default behavior of Keycloak is to load offline sessions on demand. The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> <div class="paragraph"> <p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> <div class="paragraph"> <p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> <div class="paragraph"> <p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> <div class="paragraph"> <p>There have been a couple of enhancements to the Brute Protection:</p> </div> <div class="olist arabic"> <ol class="arabic"> <li> <p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> </li> <li> <p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> </li> <li> <p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> </li> </ol> </div> </div> <div class="sect2"> <h3 id="_authorization_policy">Authorization Policy</h3> <div class="paragraph"> <p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> </div> </div> <div class="sect2"> <h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> <div class="paragraph"> <p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> </div> <div class="listingblock"> <div class="content"> <pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 kind: Keycloak metadata: name: example-kc spec: ... cache: configMapFile: name: my-configmap key: config.xml</code></pre> </div> </div> </div> <div class="sect2"> <h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> <div class="paragraph"> <p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> </div> <div class="paragraph"> <p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> </div> <div class="paragraph"> <p>You can specify your custom values based on your requirements as follows:</p> </div> <div class="listingblock"> <div class="content"> <pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 kind: Keycloak metadata: name: example-kc spec: ... resources: requests: cpu: 1200m memory: 896Mi limits: cpu: 6 memory: 3Gi</code></pre> </div> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> </div> </div> <div class="sect2"> <h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> <div class="paragraph"> <p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_updates_to_cookies">Updates to cookies</h3> <div class="paragraph"> <p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> </div> </div> <div class="sect2"> <h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> <div class="paragraph"> <p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> </div> <div class="ulist"> <ul> <li> <p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> </li> <li> <p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> </li> <li> <p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> </li> <li> <p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> </li> </ul> </div> <div class="paragraph"> <p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> </div> <div class="ulist"> <ul> <li> <p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> </li> <li> <p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> </li> <li> <p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> </li> <li> <p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> </li> </ul> </div> </div> <div class="sect2"> <h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> <div class="paragraph"> <p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> </div> </div> <div class="sect2"> <h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> <div class="paragraph"> <p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future release. If you require an external log management, consider using file log parsing.</p> </div> </div> <div class="sect2"> <h3 id="_support_for_multi_site_active_passive_deployments">Support for multi-site active-passive deployments</h3> <div class="paragraph"> <p>Deploying Keycloak to multiple independent sites is essential for some environments to provide high availability and a speedy recovery from failures. This release supports active-passive deployments for Keycloak.</p> </div> <div class="paragraph"> <p>To get started, use the <a href="https://www.keycloak.org/guides#high-availability">High Availability Guide</a> which also includes a comprehensive blueprint to deploy a highly available Keycloak to a cloud environment.</p> </div> </div> <h2>Upgrading</h2> <p>Before upgrading refer to <a href="file:/home/st/dev/keycloak-web/target/web/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> <h2>All resolved issues</h2> <h3>New features</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <code>admin/client-js</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <code>adapter/javascript</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> <li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> <li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> <li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> <li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> </ul> <h3>Enhancements</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> <li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> <li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> <li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <code>welcome/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> <li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> <li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> <li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> <li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> <li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> <li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> <li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> <li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> <li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> <li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> <li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> <li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> <li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> <li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <code>admin/client-js</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> <li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> <li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> <li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> <li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> <li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> <li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> <li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> <li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> <li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> <li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> <li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> <li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> <li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> <li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> <li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> <li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> <li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> <li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> <li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> <li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> <li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> <li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> <li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> <li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> <li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> <li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> <li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> <li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> <li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> <li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> <li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> <li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> </ul> <h3>Bugs</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <code>admin/cli</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <code>import-export</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <code>admin/cli</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <code>welcome/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <code>dependencies</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <code>adapter/javascript</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> <li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <code>admin/cli</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> <li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <code>admin/client-java</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <code>admin/cli</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> <li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> <li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <code>admin/cli</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <code>admin/client-js</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <code>admin/client-js</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <code>adapter/javascript</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> <li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> <li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <code>oidc</code></li> </ul> </div>