fidzu : JBoss

23 Jan 2025 12:00am GMT

We released Quarkus 3.17.8, the last maintenance release for our 3.17 release train. 3.18 will be released next week. UPDATE To update to Quarkus 3.17, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.17. For more information about the adjustments you need to make to your applications, please refer to the . FULL CHANGELOG You can get the full changelog of on GitHub. COME JOIN US We value your feedback a lot so please report bugs, ask for improvements… Let's build something great together! If you are a Quarkus user or just curious, don't be shy and join our welcoming community: * provide feedback on ; * craft some code and ; * discuss with us on and on the ; * ask your questions on .

22 Jan 2025 12:00am GMT

Today, we released Quarkus 3.15.3, our second (we skipped 3.15.0) maintenance release for the 3.15 LTS stream. This release contains bugfixes and documentation improvements. It should be a safe upgrade for anyone already using 3.15. UPDATE To update to Quarkus 3.15, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update --stream=3.15 Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.15. FULL CHANGELOG You can get . COME JOIN US We value your feedback a lot so please report bugs, ask for improvements… Let's build something great together! If you are a Quarkus user or just curious, don't be shy and join our welcoming community: * provide feedback on ; * craft some code and ; * discuss with us on and on the ; * ask your questions on .

21 Jan 2025 12:00am GMT

Keycloak client 26.0.4 is released. The corresponding artifacts are available in the public maven repository. This release is synced with Keycloak server 26.1.0 and allows to use latest APIs of that server version. For the details, see all the fixed issues .

17 Jan 2025 12:00am GMT

We released Quarkus 3.17.7, a new maintenance release for our 3.17 release train. UPDATE To update to Quarkus 3.17, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.17. For more information about the adjustments you need to make to your applications, please refer to the . FULL CHANGELOG You can get the full changelog of on GitHub. COME JOIN US We value your feedback a lot so please report bugs, ask for improvements… Let's build something great together! If you are a Quarkus user or just curious, don't be shy and join our welcoming community: * provide feedback on ; * craft some code and ; * discuss with us on and on the ; * ask your questions on .

15 Jan 2025 12:00am GMT

To download the release go to . HIGHLIGHTS TRANSPORT STACK JDBC-PING AS NEW DEFAULT Keycloak now uses by default its database to discover other nodes of the same cluster, which removes the need of additional network related configurations especially for cloud providers. It is also a default that will work out-of-the-box in cloud environments. Previous versions of Keycloak used as a default UDP multicast to discover other nodes to form a cluster and to synchronize the replicated caches of Keycloak. This required multicast to be available and to be configured correctly, which is usually not the case in cloud environments. Starting with this version, the default changes to the jdbc-ping configuration which uses Keycloak's database to discover other nodes. As this removes the need for multicast network capabilities and UDP and no longer using dynamic ports for the TCP-based failure detection, this is a simplification and a drop-in replacement for environments which used the previous default. To enable the previous behavior, choose the transport stack udp which is now deprecated. The Keycloak Operator will continue to configure kubernetes as a transport stack. See the guide for more information. VIRTUAL THREADS ENABLED FOR INFINISPAN AND JGROUPS THREAD POOLS Starting from this release, Keycloak automatically enables the virtual thread pool support in both the embedded Infinispan and JGroups when running on OpenJDK 21. This removes the need to configure the JGroups thread pool, the need to align the JGroups thread pool with the HTTP worker thread pool, and reduces the overall memory footprint. OPENTELEMETRY TRACING SUPPORTED In the previous release, the OpenTelemetry Tracing feature was preview and is fully supported now. It means the opentelemetry feature is enabled by default. There were made multiple improvements to the tracing capabilities in Keycloak such as: * Configuration via Keycloak CR in Keycloak Operator * Custom spans for: * Incoming/outgoing HTTP requests including Identity Providers brokerage * Database operations and connections * LDAP requests * Time-consuming operations (passwords hashing, persistent sessions operations, … ) For more information, see the guide. INFINISPAN DEFAULT XML CONFIGURATION LOCATION Previous releases ignored any change to conf/cache-ispn.xml if the --cache-config-file option was not provided. Starting from this release, when --cache-config-file is not set, the default Infinispan XML configuration file is conf/cache-ispn.xml as this is both the expected behavior and the implied behavior given the docs of the current and previous releases. INDIVIDUAL OPTIONS FOR CATEGORY-SPECIFIC LOG LEVELS It is now possible to set category-specific log levels as individual log-level-category options. For more details, see the . OPENID FOR VERIFIABLE CREDENTIAL ISSUANCE The OpenID for Verifiable Credential Issuance (OID4VCI) remains an experimental feature in Keycloak, but it has great improvements in this release. This feature benefits from much polishing of the existing configuration and making the feature more dynamic and customizable. You will find significant development and discussions in the . Anyone from the Keycloak community is welcome to join. Many thanks to all members of the OAuth SIG group for the participation in the development and discussions about this feature. Especially thanks to , , , , , and . MINIMUM ACR VALUE FOR THE CLIENT The option Minimum ACR value is added as a configuration option on the realm OIDC clients. This addition is an enhancement related to step-up authentication, which makes it possible to enforce minimum ACR level when logging in to the particular client. Many thanks to for the contribution. SUPPORT FOR PROMPT=CREATE Support now exists for the , which allows OIDC clients to initiate the login request with the parameter prompt=create to notify Keycloak that a new user should be registered rather than an existing user authenticated. Initiating user registration was already supported in Keycloak with the use of dedicated endpoint /realms//protocol/openid-connect/registrations. However, this endpoint is now deprecated in favor of the standard way as it was a proprietary solution specific to Keycloak. Many thanks to for the contribution. OPTION TO CREATE CERTIFICATES FOR GENERATED EC KEYS A new option, Generate certificate, exists for EC-DSA and Ed-DSA key providers. When the generated key is created by a realm administrator, a certificate might be generated for this key. The certificate information is available in the Admin Console and in the JWK representation of this key, which is available from JWKS endpoint with the realm keys. Many thanks to for the contribution. AUTHORIZATION CODE BINDING TO A DPOP KEY Support now exists for including support for the DPoP with Pushed Authorization Requests. Many thanks to for the contribution. MAXIMUM COUNT AND LENGTH FOR ADDITIONAL PARAMETERS SENT TO OIDC AUTHENTICATION REQUEST The OIDC authentication request supports a limited number of additional custom parameters of maximum length. The additional parameters can be used for custom purposes (for example, adding the claims into the token with the use of the protocol mappers). In the previous versions, the maximum count of the parameters was hardcoded to 5 and the maximum length of the parameters was hardcoded to 2000. Now both values are configurable. Additionally it can be possible to configure if additional parameters cause a request to fail or if parameters are ignored. Many thanks to and for the contribution. NETWORK POLICY SUPPORT ADDED TO THE KEYCLOAK OPERATOR Note Preview feature. To improve the security of your Kubernetes deployment, can be specified in your Keycloak CR. The Keycloak Operator accepts the ingress rules, which define from where the traffic is allowed to come from, and automatically creates the necessary Network Policies. LDAP USERS ARE CREATED AS ENABLED BY DEFAULT WHEN USING MICROSOFT ACTIVE DIRECTORY If you are using Microsoft AD and creating users through the administrative interfaces, the user will be created as enabled by default. In previous versions, it was only possible to update the user status after setting a (non-temporary) password to the user. This behavior was not consistent with other built-in user storages as well as not consistent with other LDAP vendors supported by the LDAP provider. NEW CONDITIONAL AUTHENTICATORS CONDITION - SUB-FLOW EXECUTED AND CONDITION - CLIENT SCOPE The Condition - sub-flow executed and Condition - client scope are new conditional authenticators in Keycloak. The condition Condition - sub-flow executed checks if a previous sub-flow was executed (or not executed) successfully during the authentication flow execution. The condition Condition - client scope checks if a configured client scope is present as a client scope of the client requesting authentication. For more details, see . DEFINING DEPENDENCIES BETWEEN PROVIDER FACTORIES When developing extensions for Keycloak, developers can now specify dependencies between provider factories classes by implementing the method dependsOn() in the ProviderFactory interface. See the Javadoc for a detailed description. DARK MODE ENABLED FOR THE WELCOME THEME We've now enabled dark mode support for all the keycloak themes. This feature was previously present in the admin console, account console and login, and is now also available on the welcome page. If a user indicates their preference through an operating system setting (e.g. light or dark mode) or a user agent setting, the theme will automatically follow these preferences. If you are using a custom theme that extends any of the keycloak themes and are not yet ready to support dark mode, or have styling conflicts that prevent you from implementing dark mode, you can disable support by adding the following property to your theme: darkMode=false Alternatively, you can disable dark mode support for the built-in Keycloak themes on a per-realm basis by turning off the Dark mode setting under the Theme tab in the realm settings. METRICS ON PASSWORD HASHING There is a new metric available counting how many password validations were performed by Keycloak. This allows you to better assess where CPU resources are used, and can feed into your sizing calculations. See and for more details. SIGN OUT ALL ACTIVE SESSIONS IN ADMIN CONSOLE NOW EFFECTIVELY REMOVES ALL SESSIONS In previous versions, clicking on Sign out all active sessions in the admin console resulted in the removal of regular sessions only. Offline sessions would still be displayed despite being effectively invalidated. This has been changed. Now all sessions, regular and offline, are removed when signing out of all active sessions. DEDICATED RELEASE CYCLE FOR THE NODE.JS ADAPTER AND JAVASCRIPT ADAPTER From this release onwards, the Keycloak JavaScript adapter and Keycloak Node.js adapter will have a release cycle independent of the Keycloak server release cycle. The 26.1.0 release may be the last one where these adapters are released together with the Keycloak server, but from now on, these adapters may be released at a different time than the Keycloak server. UPDATES IN QUICKSTARTS The Keycloak quickstarts are now using main as the base branch. The latest branch, used previously, is removed. The main branch depends on the last released version of the Keycloak server, Keycloak client libraries, and adapters. As a result, contributions to the quickstarts are immediately visible to quickstart consumers with no need to wait for the next Keycloak server release. UPDATED FORMAT OF KEYCLOAK_SESSION COOKIE AND AUTH_SESSION_ID COOKIE The format of KEYCLOAK_SESSION cookie was slightly updated to not contain any private data in plain text. Until now, the format of the cookie was realmName/userId/userSessionId. Now the cookie contains user session ID, which is hashed by SHA-256 and URL encoded. The format of AUTH_SESSION_ID cookie was updated to include a signature of the auth session id to ensure its integrity through signature verification. The new format is base64(auth_session_id.auth_session_id_signature). With this update, the old format will no longer be accepted, meaning that old auth sessions will no longer be valid. This change has no impact on user sessions. These changes can affect you just in case when implementing your own providers and relying on the format of internal Keycloak cookies. REMOVAL OF ROBOTS.TXT FILE The robots.txt file, previously included by default, is now removed. The default robots.txt file blocked all crawling, which prevented the noindex/nofollow directives from being followed. The desired default behaviour is for Keycloak pages to not show up in search engine results and this is accomplished by the existing X-Robots-Tag header, which is set to none by default. The value of this header can be overridden per-realm if a different behaviour is needed. If you previously added a rule in your reverse proxy configuration for this, you can now remove it. IMPORTED KEY PROVIDERS CHECK AND PASSIVATE KEYS WITH AN EXPIRED CETIFICATE The key providers that allow to import externally generated keys (rsa and java-keystore factories) now check the validity of the associated certificate if present. Therefore a key with a certificate that is expired cannot be imported in Keycloak anymore. If the certificate expires at runtime, the key is converted into a passive key (enabled but not active). A passive key is not used for new tokens, but it is still valid for validating previous issued tokens. The default generated key providers generate a certificate valid for 10 years (the types that have or can have an associated certificate). Because of the long validity and the recommendation to rotate keys frequently, the generated providers do not perform this check. ADMIN EVENTS MIGHT INCLUDE NOW ADDITIONAL DETAILS ABOUT THE CONTEXT WHEN THE EVENT IS FIRED In this release, admin events might hold additional details about the context when the event is fired. When upgrading you should expect the database schema being updated to add a new column DETAILS_JSON to the ADMIN_EVENT_ENTITY table. OPENSHIFT V3 IDENTITY BROKERING REMOVED As OpenShift v3 reached end-of-life a while back, support for identity brokering with OpenShift v3 has been removed from Keycloak. UPGRADING Before upgrading refer to for a complete list of changes. ALL RESOLVED ISSUES NEW FEATURES * Allow more extensive Override of BackchannelAuthenticationCallbackEndpoint core * Use optional realm attribute for authenticationrequest parameter max size/number validation configuration * Support dark mode, at least for the login pages login/ui * Operator support for setting default value of `http-pool-max-threads` operator * Used encrypted JGroups connection by default in Operator deployments operator * JDBC_PING2 as default discovery protocol * Option to specify trusted proxies dist/quarkus * Enabling authorization_details for client grant tokens until RAR is fully implemented * Provide missing user event metrics from aerogear/keycloak-metrics-spi to a keycloak mircometer event listener * Ability to specify log category levels through separate options dist/quarkus * Enhance WebAuthn registration to support custom FIDO2 origin validation * Ability to reject authentication to users without 2FA configured authentication * Allow users to specify the start page of a custom account-console theme account/ui * Authentication flow condition for client scope authentication ENHANCEMENTS * Align admin console for client for backchannel and frontchannel logout oidc * AuthenticationRequest add "create" prompt for sign-up oidc * js adapter just sets error to true upon error updateToken adapter/javascript * Additional authorization request parameters shouldn't be limited to 5 and shouldn't be discarded silently oidc * Support to enforce LoA in authentication flow for a client (Step-up) authentication * Allow custom message for brute force temporary lockout authentication * H2 Database should be opt-in and well-documented storage * Prevent "lost replace" in InfinispanAuthenticationSessionProvider storage * Maximum 100 resources with same URI checked when requesting permissions by URI authorization-services * Allow to restrict ProviderConfigProperty input to int values * Generalize or remove stack trace information found in error message exception handling * Keycloak native verification of an SD-JWT based vp_token oid4vc * Run tests with original `keycloak` login theme in nightly * Allow to create certificates for provider-keys authentication * OTEL: Add Keycloak CR support for Tracing options operator * OTEL: Apache HTTP client OpenTelemetry instrumentation * [Documentation] - Configuring trusted certificates - Fully specify truststore path dist/quarkus * OTEL: Instrument parts of Keycloak with OTEL spans * Clarify the behaviour of multiple Operator versions installed in the same cluster operator * Readonly profile attribute profile has unwanted not translated placeholder account/ui * [OID4VCI] Migrate Verifiable Credential Definitions from Client Attributes to Realm Level Attributes oid4vc * Explicitly document that the Operator does not create an Ingress for Admin URL operator * Add ui to override patternfly colors and logo * Better logging when error happens during transaction commit storage * Consolidate the logic for determining a local address core * Remove retry in LoginPage.resetPassword testsuite * Add CopyToClipboardButton to UserID in Admin UI * Expose membership type in the Admin UI for organization members admin/ui * Add an example nginx reverse proxy configuration * Show User Events on dedicated tab on Client-/User-Details * Add a reference to http-enabled in TLS/SSL setup * Upgrade Infinispan to 15.0.10.Final * Utilise `jdbc-ping` TCP based JGroups stack as default for non-operator Keycloak deployments * Make createWebAuthnRegistrationManager protected to allow cutomizations in subclasses authentication/webauthn * Prevent Keycloak from starting with wrong `work` cache configuration * Create a new base login theme * Add switch to disable dark mode * Background SQL statements show without a connected trace dist/quarkus * Enable virtual threads in Infinispan and JGroups by default * Update KEYCLOAK_SESSION cookie to not have sessionId in plain-text authentication * Sign the AUTH_SESSION_ID cookie value authentication * Username Form should support autocomplete login/ui * Standardize error messages from client and server in login theme (keycloak.v2) login/ui * Deprecate other transport stacks (ec2, azure, google) * Add JDBC_PING2 stacks for both TCP and UDP * Keycloak-admin-client should work with the future versions of Keycloak server admin/client-java * Update the Keycloak CPU and Memory sizing guide to reflect the new ec2 workder nodes * Delete Openshift 3.x identity provider * Support for the Croatian language * Remove remaining table USERNAME_LOGIN_FAILURE from the jpa UserSessionProvider times * Make the organization chapter of Server Admin guide available on downstream * Some dynamic imported functions are also statically imported making bundling them in-efficient * Improve build time of the js module * Add ability to enable support for Verifiable Credentials per Realm account/ui * Make cache-remote-host available when feature multi-site or cache-embedded-remote-store is enabled * Make documentation more clear that keycloak javascript adapter and node.js adapter are OIDC docs * Microsoft login - add prompt param configure * Avoid multi-release and java16 specific sources in the core module oidc * Update certain email templates for password recovery to match English translation format * Document network ports for Keycloak clustering * [Operator] Enhance the Keycloak Operator with Network Policies operator * Allow custom OIDCIdentityProvider implementations to specfiy the supported token types identity-brokering * OTEL: Provide Tracing SPI * Disable trim_trailing_whitespace in editorconfig to reduce noise in PRs * Improving the error message when failing to query an LDAP provider ldap * Allow a request object by considering a clock skew for smooth interoperability oidc * Allow a JWT client assertion by considering a clock skew for smooth interoperability oidc * Too many exceptions created when validating user profile * Avoid throwing exceptions when issuing reflection on user model * Add conditional text to Installation Locations * Update Leveraging JaKarta EE in Server Development guide * Feature: Allow disabling XA enforcement introduced with v26 dist/quarkus * Edits to Authorization Services guide * Allow a DPoP Proof by considering a clock skew for smooth interoperability * Addresse QE comments on Server Administration guide * Upgrade to ISPN 15.0.11.Final * Authorization Code Binding to a DPoP Key and DPoP with Pushed Authorization Requests oidc * Expose templateName in attributes when rendering freemarker templates login/ui * Upgrade to Quarkus 3.15.2 dist/quarkus * Prefer usage of StandardCharsets.UTF_8 over "UTF-8" charset reference core * [LoginUI] Set HTML lang attribute to "en" when internationalization disabled account/ui * Improve test method signature and gather more info about assertions testsuite * Resolve scopes from authenticated client sessions when selecting attributes * Allow configuring retries for JavaScript tests using environment variable ci * Allow asking for additional scopes when querying the account console root URL * Add WHY issues are important for each PR no matter how small to CONTRIBUTING.md docs * CONTRIBUTING.md has confusing ordered list with two times point 5 * Updated tested PostgreSQL version to 17 * Updated tested MariaDB version to 11.4 * Updated tested MySQL version to 8.4 * Consistent use of log.debugf to avoid generating too much GC overhead * Add a page with an index that links to smaller pages (JVM, HTTP, Database, embedded caches, external Infinispan) - we can show example widgets from the dashboards later * OTEL: Enhance traces with spans for each RestEASY resource * OTEL: Show spans in transaction completion at the end of a request * OTEL: Group persistent session work activities in parent span or link them * Avoid creating ObjectMapper but using JsonSerialization utility class when managing event details * Add password validation to update-password * Support for multiple values of some parameters in the grant SPI oidc * Update the Enabling Keycloak Event Metrics guide with the list of possible events and errors * Update release notes for Keycloak 26.1.0 with new community additions docs * [Operator] Network Policy Rules operator * Removing unnecessary configuration from auth servers * Update the sizing guide with an indicator on which user events to use * Reduce debounce time in RealmSelector * Replace `uuid` module with `crypto.randomUUID()` * Set the LDAP connection pooling protocols by default to plain and tls * Document the performance numbers from the ARM based ROSA cluster runs * Add a test that the metrics listed in the docs are available from Keycloak (keep it simple, ignore metrics that don't show up right after the start) * Use MeterProvider as suggested by the Micrometer team to avoid GC overhead * Enable LDAP Connection pooling by default * Release note about node.js adapter and javascript adapter released independently of keycloak server docs * Update upgrading notes with the changes related to core clients docs * Rescue dutch translations from aborted Weblate PR * Update the CA translation translations * Tune caching guide list of stacks for the upcoming release * Align realm name placeholder in the docs docs * Add metric for number of password validations * OTEL: Add tracing for credential validation * Suggestion: Improve Regex for NPM Version Conversion in set-version.sh ci * Allow tracing packets sent to and from LDAP for troubleshooting purposes * Help texts in the admin UI should end with a dot admin/ui * OTEL: merge Operator tracing test cases * Rename `org.keycloak.test.framework` package to `org.keycloak.testframework` test-framework * Rename `org.keycloak.test` package to `org.keycloak.tests` test-framework * Make @EnableFeature to handle the case with added provider of currently non-used SPI testsuite * Prepare a new guide for Keycloak's own metrics in the observability guide BUGS * keycloak.js example from the documentation leads to error path adapter/javascript * Locale Setting for Update Password Mail admin/api * Race when creating client protocol mappers (ClientManager#enableServiceAccount) resulting in duplicate entries storage * Incorrect get the members of a group imported from LDAP ldap * IllegalArgumentException on canceled Account Linking oidc * Step-up authentication with existing cookie not working when using `Authentication Flow Overrides` per client authentication * Broken Promise implementation for AuthZ JS adapter/javascript * Backchannel Logout silently not sent, if Frontchannel Logout is enabled as well oidc * oidc - JavaScript-Adapter LocalStorage#clearExpired does not clear all possible items adapter/javascript * Documentation - Expand/Clarify Admin REST API User Search Functionality admin/api * the InfoPage after an ExecuteActionsEmail is not localized based on the user's locale authentication * robots.txt causes indexing authentication/webauthn * Incorrect ldap-group-mapper chosen to sync changes to ActiveDirectory when several mappers with varying group paths used ldap * Uncaught (in promise): QuotaExceededError adapter/javascript * Issue with concurrent user & group delete, unable to cleanup resource server user-policy & group-policy authorization-services * Members are inhereted from LDAP group with the same name ldap * When using `oidcProvider` config url (.well-known) it's not possible to use `silentCheckSsoRedirectUri` adapter/javascript * JavascriptAdapterTest errors when running with strict cookies on Firefox ci * Broken (read-only) database connections not getting removed from connection pool, keycloak claims to be healthy. storage * Inconsistent TypeScript definitions in the module @keycloak/keycloak-admin-client while compiling admin/client-js * Workflow error: Base IT - RefreshTokenTest#refreshTokenWithDifferentIssuer testsuite * Allow increasing wait time on each failure after the max number of failures is reached authentication * update brute force docs to reflect available lockouts modes (temporary / permanent / mixed) authentication * Social login - Stack Overflow test fails ci * NPE on External OIDC to Internal Token Exchange when Transient Users feature is enabled token-exchange * Declining terms and conditions in account-console results in error account/ui * some GUI validation check missing admin/ui * Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#createRemoveClient ci * Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#createClient ci * Unstable test KerberosStandaloneCrossRealmTrustTest.test03SpnegoLoginWithCorrectKerberosPrincipalRealm ci * When the Delete Credential required action is set to false an authentication application cannot be removed from the account UI core * Make sure it is not possible to run snapshot server against production DB by default core * Event type not set in reset-credential flow under some conditions resulting in an error page authentication * Upgrade to 25 throws: Statement violates GTID consistency core * Organization API not available from OpenAPI documentation admin/api * Workflow failure: WebAuthn IT (firefox) - WebAuthnSigningInTest:navigateBeforeTest ci * Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently ci * token exchange: exchange-sequence still fails with `Client session for client '..' not present in user session` when starting on public client token-exchange * Offline sessions are not removed from admin console after sign out all active sessions core * Selection list does not close after outside click admin/ui * Enabling/Disabling user does not work with Microsoft AD LDAP via Admin API/UI ldap * Show account page before login core * Misleading docs and functionality around cache-ispn.xml dist/quarkus * Error when non-admin user accesses admin console admin/fine-grained-permissions * Logout not working after removing Identity Provider of user identity-brokering * KC doesn't enforce uniqueness of aliases in Authentication flows, but uses them as identifiers (in config export) authentication * Windows builds fail too often due to problems with the download of Node ci * Repeated email verifications while logging in through IDP caused by email case sensitivity authentication * UserId too long to add Security Key WebauthN authentication/webauthn * LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and user already exists ldap * High CPU usage on logout when using remote Infinispan only setup infinispan * none of the enabled features are shown as such in the admin console docs * creating short admin password in BCFIPS approved mode gives "Internal server error" page core * "Cookie not found" in multi-step auth flows / mobile browsers core * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginAgainWithoutRememberMe ci * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginMissingUsername ci * addExecutionFlow endpoint does not return right ID admin/api * Nightly Cypress tests for the Admin Console are failing on Firefox admin/ui * RP-Initiated logout using `POST` method fails in cross-origin setup oidc * Requesting `offline_access` without an established session results in two sessions oidc * Authentication sessions do not handle concurrent writes core * Flaky test: org.keycloak.testsuite.forms.BrowserButtonsTest#appInitiatedRegistrationWithBackButton ci * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginWithRememberMe ci * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginRememberMeExpiredMaxLifespan ci * Organization Domain not marked as a required field in the Admin UI admin/ui * Requested `grant_types` inconsistent with created `grant_types` for OpenID Connect Dynamic Client Registration oidc * Login V2: Missing "dir" attributes login/ui * Admin UI defaults to master realm even without permissions to it admin/ui * Consider Replacing Monaco Editor or Bundling Resources Locally to Avoid CSP Conflicts admin/ui * Possible issue with unavailable CryptoIntegration when using keycloak-authz-client with private_key_jwt and ECDSA algorithm oidc * Role descriptions do not wrap in the UI admin/ui * Incorrect Disclosure Handling in SdJwtVP.of(String) Method oid4vc * RESTART_AUTHENTICATION_ERROR in Iphone devices (using safari and chrome browser) oidc * Passkeys: Infinite (re-)loading loop on browsers with WebAuthn Conditional UI disabled authentication/webauthn * Duplicate principals not allowed in keystore authentication * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginWithEmailUserAndRememberMe ci * Any one Client role mapping to user/group generating two events on admin events tab. core * 400 error logged as 500 identity-brokering * Icons for social providers broken in login screen if the provider is created with non-default alias admin/ui * Admin UI e is undefined if required action recreated with own alias admin/ui * Double scroll bar due to warning banner admin/ui * Wrong translation issues in greek translation translations * Permission cannot be evaluated when only role and client are provided authorization-services * Link to existing account form: IDP Alias displayed instead of IDP Display Name login/ui * 404 in admin console when unlinking managed user from organizations admin/ui * Flaky test: org.keycloak.testsuite.forms.LevelOfAssuranceFlowTest#testWithOTPAndRecoveryCodesAtLevel2 ci * Can get authorization code on a non verified user with some specific kc_action (AIA) oidc * Previously entered translations should persist in the translation dialog for the attribute groups admin/ui * Keycloak In Docker: ERROR: Strict hostname resolution configured but no hostname setting provided docs * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * Unable to submit forms in Safari account/ui * Broken links / anchors after KC26 release docs * In imported realms, the ability to use environment variables has disappeared import-export * Fix runaway asterisk formatting in TLS documentation docs * Cleanup how static state is set for import / export dist/quarkus * Upgrade Selenium testsuite * Repeated "to a" in the help text for the "User Attribute" mapper admin/ui * Fix v2 login layout login/ui * Client Secret Required Bug When Using "JWT Signed with Private Key" for (Keycloak/) OpenID Connect Provider admin/ui * No message for `policyGroupsHelp` admin/ui * ClassNotFoundException OracleXADataSource/OracleDataSource using IDELauncher with Keycloak 26.0.0 dist/quarkus * Non-optimized start command gives erroneous warnings for runtime spi options dist/quarkus * Customizable footer (Keycloak 26) not displaying in keycloak.v2 login theme login/ui * RTL not working on keycloak.v2 login template login/ui * Validation of http truststore or keystore file masks if the file exists dist/quarkus * Test "Duplicate Group" unstable in Admin UI / job is failing admin/ui * Failure to redirect to organization IdP when the organization scope is included organizations * Not possible to configure custom client authenticator in Admin UI authentication * Client Scope updates are not replicated on a distributed keycloak setup in kubernetes admin/api * Client Policy throws "Invalid Redirect Uri" if Standard Flow is disabled oidc * Organizations section is shown in account console if organizations is not enabled for a realm. account/ui * Aurora IT tests failing periodically with download of node ci * Admin client returns HTTP code `400 Bad Request` when using x509 certificate admin/client-java * [Regression] 26.0.0 return empty "access: []" JWT for Docker-v2 Auth provider, resulting in "access denied" authentication * Error when adding or removing a user from an organisation when there are 2 or more Keycloak servers in a cluster organizations * Upgrade to 26 fails with 'ERROR: index "idx_us_sess_id_on_cl_sess" does not exist' core * FOUC in Firefox on login UI login/ui * CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus * Stabilise my-resources.spec test account/ui * NPE when device representation cannot be parsed authentication * NEP when Default Role is not present on CachedRealm infinispan * client-jwt ES256 error when doing CODE_TO_TOKEN oidc * Wrong documentation link in keycloak-js readme docs * [Keycloak CI] - AuroraDB IT - Error creating EC2 runner instance * [Keycloak CI] - FIPS IT - Failed to fetch maven * Auth not possible for auth session where user was enabled in the meantime authentication * Not persisted config settings prevent server start dist/quarkus * NPE thrown in whoami endpoint admin/ui * Recovery authentication codes are numbered inconsistently login/ui * ResetPasswordTest.resetPasswordExpiredCode Error -> AbstractKeycloakTest.deleteAllCookiesForRealm:297 core * Cannot install latest version (26.0.0) of the adapter using Galleon adapter/jee * [PERF] OpenTelemetry is initialized even when disabled * password is a required field admin/ui * Not possible to close dialog boxes when clicking buttons or the close icon admin/ui * Windows kc.bat handling of serveral parameter types is not correct dist/quarkus * keycloak.v2 registration: Password policy validation error "errorList is null" login/ui * Doc CI - broken links error docs * Handle removal of online session for the directGrant and clientCredentials * Handle removal of online session for authorization_code when `scope=offline_access`is used oidc * grammatical error in "Managing Organizations" documentation docs * Add More Info to Organization Events organizations * Home URL for security-admin-console is broken admin/ui * [Admin UI] Broken autocomplete input on the "Create resource-based permission" form admin/ui * Flaky Test ResetPasswordTest.resetPasswordLoggedUser:188->openResetPasswordUrlAndDoFlow:252 testsuite * Custom keycloak login theme styles.css return error 404 login/ui * [Windows] Wrong expansion of ${kc.home.dir} causes NoSuchFile exception dist/quarkus * LDAP Pagination not working for role membership in GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE strategy ldap * Org Invite: `linkExpiration` template variable represents 54 years in minutes organizations * Listing federated LDAP users is very slow with import enabled ldap * Onclick focus issue in the Username field of Clients / / Client Scopes / Evaluate admin/ui * Respect the locale set to a user when redering verify email pages user-profile * Users without `view-realm` can't see user lockout state in Admin UI admin/ui * Do not show domain match message in the identity-first login when no login hint is provided organizations * The Realm Selection Dropdown Breaks After 50 Realms In Database admin/ui * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * java.util.ConcurrentModificationException when process user sessions update infinispan * Keycloak 26.0.0/26.0.1 Import Issue: Multiple Realms Not Imported, Duplicated Realm Imported Instead import-export * Group select dialog: Subgroups not displayed initially due to pagination admin/ui * JS password validation doesn't work as intended with uppercase and lowercase minimum requirements login/ui * cli options starting or ending with ; or containing ;; mangle the cli handling dist/quarkus * Grant type "urn:ietf:params:oauth:grant-type:uma-ticket" token service endpoint returns NullPointerException authorization-services * OIDC IdP Unable to validate signatures using validatingPublicKey certificate admin/ui * logout with client_id and/or post_logout_redirect_uri results in bad request on logout confirmation page oidc * Deleting a user leads to ISPN marshalling exception * Group search in user view doesn't work as expected for nested groups admin/ui * Service accounts visible under user search in Admin console admin/api * Docs: Dead link docs * Flaky Test: BrowserFlowTest.testAlternativeNonInteractiveExecutorInSubflow() testsuite * PEM files distributed as part of SAML adapter configs are missing -----BEGIN and -----END blocks saml * NullPointerException in ConditionalOtpFormAuthenticator.java authentication * Remove inaccurate statement about master realm imports docs * Fix DB overflow for EVENT_ENTITY table and SESSION_ID column in case that incorrect data are sent core * NPE in Organization(s)Resource when using Quarkus Rest Client admin/api * ParEndpoint#request corrupts values added in request object oidc * Admin UI doesn't show realms when using login through identity provider admin/fine-grained-permissions * Incorrect Content-Type Expectation for POST /admin/realms/{realm}/organizations/{id}/members in Keycloak API admin/api * [Keycloak 26.0.2] Getting "Forbidden, permission needed: query-clients" as temp-admin admin/ui * LDAP: searching users with import disabled is slower since fix for 34050 ldap * Flaky test: org.keycloak.testsuite.broker.KcSamlBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * [Trivy] - Workflow failure ci * NullPointerException in RoleResolveUtil when admin-cli uses lightweight token admin/cli * [26.0.2] Migration from 25.0.1 Identity Provider Errors identity-brokering * kc.config.args exposed in show-config dist/quarkus * Missing help icons in Webauthn Policy and Webauthn Passwordless Policy missing in admin ui admin/ui * Do not rely on the `pwdLastSet` attribute when updating AD entries ldap * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * Username and password should be optional for multi-site deployment infinispan * Clicking on link to Keycloak documentation from Keycloak admin UI does nothing instead of opening documentation admin/ui * Flaky test: org.keycloak.testsuite.actions.TermsAndConditionsTest#termsDeclined ci * Renaming realm in UI broken admin/api * Non compliant OpenID Client Authentication when `client_secret_jwt` with PAR (Pushed Authorization Requests) oidc * Quarkus dev mode does not work dist/quarkus * Flaky test: org.keycloak.testsuite.forms.ResetPasswordTest#resetPasswordLinkTestAppWithoutRedirectUriParam ci * Switching 'Email as Username' alters existing custom usernames to email addresses, causing LDAP sync issues core * Text in "Choose a policy type" is not wrapping admin/ui * Attributes missing in OrganizationRepresentation when using Admin REST API in Keycloak 26 admin/api * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * Rework global event listener for metrics core * NPE in InfinispanOrganizationProvider if userCache is disabled infinispan * Error on testsuite "group_test" on Cypress admin/ui * AdminEventQueryTest test fails after adding global event listener core * Remove duplicate lines in userprofile freemarker template login/ui * Fix typo in log message account/ui * Securing apps guide breaks downstream docs * Missing downstream explicit name for anchors docs * Feature in higher version takes precedence even if it has lower type order * Client Protocol Mappers with non UUID ids cannot be edited admin/ui * KC_CACHE_EMBEDDED_MTLS_ENABLED is ignored infinispan * Continuous reload when KC_AUTH_SESSION_HASH expires authentication * `ClientConnection.getRemoteAddr` can return a hostname when behind a reverse proxy core * Keys tab showing disabled and inactive keys as active admin/ui * [Admin UI] [Create resource-based permission] Resource input is disabled admin/ui * New credential templates broken in KC26 login/ui * calling openid-connect/auth with previous version valid cookies generate internal server error authorization-services * Invalid flag for addDefaultRequiredActions infinispan * GroupMappersTest test fails in keycloak-client core * CVE-2024-10973 - Cleartext Transmission of Sensitive Information in org.keycloak:keycloak-quarkus-server * AdminUI: Alphabetically sort "Event saved type" in the events listing admin/ui * Log handler specific log levels support only lower-case levels dist/quarkus * Liquibase outputs update summary directly to standard out dist/quarkus * [Keycloak CI] - Base IT - KerberosLdapCrossRealmTrustTest.test03SpnegoLoginUsernamePassword ldap * [Jenkins Keycloak CI] - Cookies Tests - KcOidcBrokerPrivateKeyJwtCustomAudienceTest ci * [Jenkins Keycloak CI] - Cookies Tests - KcSamlBrokerTest * [Jenkins Keycloak CI] - Cookies Tests - KcOidcBrokerLdapTest ci * Keycloak needs to return "invalid_request" from Token Endpoint if a token or refresh request lacks DPOP proof oidc * [Keycloak CI] - Quarkus IT - StartCommandDistTest and BuildAndStartDistTest dist/quarkus * [Jenkins Keycloak CI] - Adapter Cookies Tests - Failures with Firefox strict cookies ci * Deprecated CLI options and new options are not stable in their sorting dist/quarkus * On logout from admin console, a serverinfo call with 401 response in the logs admin/ui * Clients invalidated on each client credential grant core * Incomplete registration form when edit email is disabled and email is set as username user-profile * Authentication Link and IDP Fails with 400 Bad Request After Migrating to Version 26 and Delete Authentification authentication * Upgrade 24 to 25 fails because db jpa changes drop nonexisting indexes. core * [Keycloak CI] Outdated surefire artifacts names - Quarkus IT and UT ci * Update Email doesn't update username when Email as Username and Attributes are enabled user-profile * Adding "sub" claim to lightweight access token causes HTTP 403 Forbidden Error in Keycloak 26.0.5 oidc * Unable to scroll/swipe through the main menu on macOS admin/ui * ES256 key continue to be used to sign token even after expiry oidc * getAll() organization members only returns the first 10 members organizations * KC25 Migration guide for caching options needs clarification * MySQL database migration issue core * Mis-formatted unordered list in the caching docs * Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsRemoval ci * PersistentSessionsWorker: retry with 0 backoff ms. core * Filter events by user id and client not working admin/ui * `organizationEnabled` and `verifiableCredentialsEnabled` attributes are present as attributes in an export * Cannot request additional scopes when using the account console account/api * Flaky test: org.keycloak.testsuite.broker.KcSamlBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled core * Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsCreation ci * Flaky test: org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenTimeIsValid ci * CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process * CVE-2024-10270 Potential Denial of Service * CVE-2024-10492 Keycloak path trasversal * CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability * CVE-2024-10039 Bypassing mTLS validation * Account UI E2E / `personal-info/personal-info.spec.ts` is unstable ci * Typo www.recatcha.net -> www.recaptcha.net in docs docs * Fix typo in v24 changelog: "longer" -> "no longer" docs * reCAPTCHA v3 not working login/ui * Links to guides in Observability section are still pointing to server section docs * Typos in `.md` and `.adoc` files, detected using codespell and manual review docs * Edit Help Mode descriptor for Roles in policy form admin/ui * Your login attempt timed out authentication * Upgrade 26.0.5 -> 26.0.6 completely breaks admin events in the admin UI admin/ui * Maven clean shouldn't be skipped by default on Windows * Database migration fails after upgrading operator to v26.0.6 core * Token issuer is null in executeActionsEmail and sendVerifyEmail if no clientId is passed admin/api * Strange Random behavior - Intermittent missing organization claim in Keycloak JWT token organizations * Error when creating a permission ticket when there are 2 or more Keycloak servers in a cluster authorization-services * Errors in persian and tukish translations in account translations * Multiselect Checkboxes in user profile don't allow to unset value user-profile * Resolve scopes from bearer tokens when processing requests to the Account API * log-syslog-max-length is ignored dist/quarkus * [Keycloak CI] - Quarkus UT (windows-latest) - Keycloak Quarkus Server Deployment ci * SAML Adapter Galleon Pack for EAP8 cannot use new metadata options for layers adapter/saml * Capitalization in Hungarian translation needs improvement translations * Mis-formatted definition list of hashing algorithms * Showing LDAP error message when failing to reset password ldap * OTEL: OTelTracingProvider should be request-scoped dist/quarkus * access token or refresh token will be reset when another is set admin/ui * Flaky test: org.keycloak.testsuite.model.DBLockTest.testTwoLocksCurrently ci * Update Infinispan examples in the High Availability guide docs * Delete user confirm title is wrong admin/ui * Events: Wrong text for user id search admin/ui * Event Representation is not shown for Admin Events in UI admin/ui * When using the token revocation endpoint with refresh-token, all sessions from the user+client are terminated oidc * [Jekins Keycloak CI] - RH-SSO EAP adapters remote saml tests ci * `QuarkusPropertiesDistTest` fails on Windows testsuite * Initial keycloak bootstrap suggestion is not correct. dist/quarkus * IPA-Tuura federation: password field shows password in plaintext core * Upgrading guide 26.0.6 is missing in the built document docs * JVM crash when running base testsuite test from command line using auth-server-quarkus-embedded dist/quarkus * Invoking `BaseUpdater.markDeleted()` more than once cause the transient status to be lost infinispan * Embedded test server fails when running from `mvn` dist/quarkus * Code quote for http-enabled is incorrect, missing relevant option in reverse proxy documentation docs * Fix broken Dependabot configuration * Temporary password toggle in set password dialog is cut off in admin-console admin/ui * Inconsistency when returning user attributes when executing a seach or fetching users by ID from external user storage providers ldap * Improve sssd note about synchronization of groups docs * realm_test.spec fails on firefox admin/ui * New install doesn't allow admin user creation dist/quarkus * token exchange response expires_in inconsistent behavior token-exchange * Support for X-Forwarded-Prefix should not be implied docs * POST create client with id exceed 36 characters length response status 500 instead of 403 admin/api * Missing userId in LOGIN_ERROR event for permanent lockout authentication * GET .../organizations/{id}/members/{id} multiple ids organizations * Event for setting up recovery codes authentication * Fix grammar in documentation page docs * Typo in using custom Keycloak image for Operator guide docs * Quarkus.properties should not use -cf or --config-file flag docs * Update to KC 26.x from core * Keycloak incorrect usage of UserPolicy and cache. authorization-services * Keycloak arquillian testsuite not working with the default profile testsuite * Token revocation may not correctly revoke related access tokens * Exact searches should be the default when querying user by attributes admin/api * Regression Mysql 8 support as the upgrade script do not use temporary table storage * Selected Organization not present in access_token of different client within same Realm if user belongs to multiple organization organizations * Unused LDAP provider options are still exposed * Selecting one role selects all admin/ui * MapComponent UI Not Displaying Saved Values in Keycloak React Admin UI admin/ui * Typo in username pt_BR translation in account console account/ui * Failing since may be reported incorrectly on health probe dist/quarkus * Map Configuration Property in Custom UserStorageProviderFactory Not Displayed in UI After Saving admin/ui * Organization Scope mismatch organizations * Duplicate entry in admin message properties admin/ui * Broken links in getting-started guide pointing to quickstarts latest branch docs * Flaky test: org.keycloak.testsuite.forms.BruteForceTest#testExceedMaxTemporaryLockouts ci * Wrong content-type for content.json account/ui * Unable to use custom handlers for HTTP OPTIONS method in subresources dist/quarkus * Double submit on otp form causes error login/ui * Translations specified in the admin console do not override the translations specified in a theme translations * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTokenExchangeTest#testInternalExternalTokenExchangeStoredToken ci * IDPs can not be found anymore by "Issuer" value when exchanging tokens identity-brokering * Unnecessary text in documentation docs * NPE when Kerberos Server is unreachable core * Incompatible method of admin-client in Keycloak 26.1 and missing javadoc admin/client-java * max-count for session caches is not set by default for local Infinispan config dist/quarkus * Issue with "403 Forbidden" Access /admin/realms/{realm}/authentication/executions/{executionId} admin/api * Fix invalid url in keycloak.js log message adapter/javascript * "Remove role" alert text is wrong admin/ui * Profile attribute inputs incorrectly marked as required when minimum length is configured admin/ui * Error when re-authenticating when organization is enabled organizations * PasswordAgePolicy triggering NullPointerException when credentail does not have createdDate core * KeycloakServer application not working anymore testsuite * PersistentSessionsWorker: Cannot access delegate without a transaction ldap * Roll-back change to startup timeout operator * [Keycloak CI] - Bse IT/Store IT - IdentityProviderTest ci * CVE-2024-11736 Unrestricted admin use of system and environment variables * CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers * Metric `vendor_jgroups_*` is unstable and can change in upcoming releases infinispan * When running Keycloak in testutils with Undertow, the admin UI thows NoMessageBodyWriterFoundFailure admin/ui * Too much space around "Forgot Password" button (keycloak.v2) login/ui

15 Jan 2025 12:00am GMT

Explore how to combine Quarkus, a modern Java framework optimized for cloud-native applications, with Ollama, a platform for running AI models locally with Jonathan Vila's article "Building local LLM AI-Powered Applications with Quarkus, Ollama and Testcontainers". Long Term Support (LTS) releases are designed for users who want to keep a given version for a longer period of time instead of following our monthly release pace. Quarkus 3.20 will be our next LTS version planned for release in late March. Read more about it in the blog post "Our next LTS will be Quarkus 3.20" from Guillaume Smet. Customizing your test resource manager and using a unified configuration, you can eliminate conflicts between the containers used by Liquibase and your application. Learn how in "Resolving Issues with Quarkus Tests, Test Containers, and Liquibase Integration" by tempmailgenerator on Reddit. You will also see the latest Quarkus Insights episodes, top tweets/discussions and upcoming Quarkus attended events. Check out ! Want to get newsletters in your inbox? using the on page form.

14 Jan 2025 12:00am GMT

KEYCLOAK TERRAFORM PROVIDER RELEASES We're excited to announce the release of the Keycloak Terraform Provider 5.0 with support for Keycloak 24/26. You can find the repository . Following our , we released Keycloak Terraform Provider 4.5 with a new license and dependency upgrades for Keycloak versions older than 23.0.0. If you are still using the old Keycloak Terraform Provider by you can take a look at the to use the new . CHANGES 4.5 MAINTENANCE RELEASE * CVE fixes * Go upgrade * Minor Dependency Upgrades * License change 5.0 RELEASE * Support for Keycloak 24 * Support for Keycloak 26 * Dependency Upgrades PLANNED NEXT RELEASES * 5.1 with support for managing organizations * patch releases on demand JOIN THE COMMUNITY We're grateful for all contributors who've helped make the Terraform Provider what it is today. We welcome new contributions, issue reports, feature suggestions, and fixes. Let's work together to make it even better! Explore the , join , and help shape the future of the Keycloak Terraform Provider.

13 Jan 2025 12:00am GMT

To download the release go to . HIGHLIGHTS TRANSPORT STACK JDBC-PING AS NEW DEFAULT Keycloak now uses by default its database to discover other nodes of the same cluster, which removes the need of additional network related configurations especially for cloud providers. It is also a default that will work out-of-the-box in cloud environments. Previous versions of Keycloak used as a default UDP multicast to discover other nodes to form a cluster and to synchronize the replicated caches of Keycloak. This required multicast to be available and to be configured correctly, which is usually not the case in cloud environments. Starting with this version, the default changes to the jdbc-ping configuration which uses Keycloak's database to discover other nodes. As this removes the need for multicast network capabilities and UDP and no longer using dynamic ports for the TCP-based failure detection, this is a simplification and a drop-in replacement for environments which used the previous default. To enable the previous behavior, choose the transport stack udp which is now deprecated. The Keycloak Operator will continue to configure kubernetes as a transport stack. See the guide for more information. VIRTUAL THREADS ENABLED FOR INFINISPAN AND JGROUPS THREAD POOLS Starting from this release, Keycloak automatically enables the virtual thread pool support in both the embedded Infinispan and JGroups when running on OpenJDK 21. This removes the need to configure the JGroups thread pool, the need to align the JGroups thread pool with the HTTP worker thread pool, and reduces the overall memory footprint. OPENTELEMETRY TRACING SUPPORTED In the previous release, the OpenTelemetry Tracing feature was preview and is fully supported now. It means the opentelemetry feature is enabled by default. There were made multiple improvements to the tracing capabilities in Keycloak such as: * Configuration via Keycloak CR in Keycloak Operator * Custom spans for: * Incoming/outgoing HTTP requests including Identity Providers brokerage * Database operations and connections * LDAP requests * Time-consuming operations (passwords hashing, persistent sessions operations, … ) For more information, see the guide. INFINISPAN DEFAULT XML CONFIGURATION LOCATION Previous releases ignored any change to conf/cache-ispn.xml if the --cache-config-file option was not provided. Starting from this release, when --cache-config-file is not set, the default Infinispan XML configuration file is conf/cache-ispn.xml as this is both the expected behavior and the implied behavior given the docs of the current and previous releases. INDIVIDUAL OPTIONS FOR CATEGORY-SPECIFIC LOG LEVELS It is now possible to set category-specific log levels as individual log-level-category options. For more details, see the . OPENID FOR VERIFIABLE CREDENTIAL ISSUANCE The OpenID for Verifiable Credential Issuance (OID4VCI) remains an experimental feature in Keycloak, but it has great improvements in this release. This feature benefits from much polishing of the existing configuration and making the feature more dynamic and customizable. You will find significant development and discussions in the . Anyone from the Keycloak community is welcome to join. Many thanks to all members of the OAuth SIG group for the participation in the development and discussions about this feature. Especially thanks to , , , , , and . MINIMUM ACR VALUE FOR THE CLIENT The option Minimum ACR value is added as a configuration option on the realm OIDC clients. This addition is an enhancement related to step-up authentication, which makes it possible to enforce minimum ACR level when logging in to the particular client. Many thanks to for the contribution. SUPPORT FOR PROMPT=CREATE Support now exists for the , which allows OIDC clients to initiate the login request with the parameter prompt=create to notify Keycloak that a new user should be registered rather than an existing user authenticated. Initiating user registration was already supported in Keycloak with the use of dedicated endpoint /realms//protocol/openid-connect/registrations. However, this endpoint is now deprecated in favor of the standard way as it was a proprietary solution specific to Keycloak. Many thanks to for the contribution. OPTION TO CREATE CERTIFICATES FOR GENERATED EC KEYS A new option, Generate certificate, exists for EC-DSA and Ed-DSA key providers. When the generated key is created by a realm administrator, a certificate might be generated for this key. The certificate information is available in the Admin Console and in the JWK representation of this key, which is available from JWKS endpoint with the realm keys. Many thanks to for the contribution. AUTHORIZATION CODE BINDING TO A DPOP KEY Support now exists for including support for the DPoP with Pushed Authorization Requests. Many thanks to for the contribution. MAXIMUM COUNT AND LENGTH FOR ADDITIONAL PARAMETERS SENT TO OIDC AUTHENTICATION REQUEST The OIDC authentication request supports a limited number of additional custom parameters of maximum length. The additional parameters can be used for custom purposes (for example, adding the claims into the token with the use of the protocol mappers). In the previous versions, the maximum count of the parameters was hardcoded to 5 and the maximum length of the parameters was hardcoded to 2000. Now both values are configurable. Additionally it can be possible to configure if additional parameters cause a request to fail or if parameters are ignored. Many thanks to and for the contribution. NETWORK POLICY SUPPORT ADDED TO THE KEYCLOAK OPERATOR Note Preview feature. To improve the security of your Kubernetes deployment, can be specified in your Keycloak CR. The Keycloak Operator accepts the ingress rules, which define from where the traffic is allowed to come from, and automatically creates the necessary Network Policies. LDAP USERS ARE CREATED AS ENABLED BY DEFAULT WHEN USING MICROSOFT ACTIVE DIRECTORY If you are using Microsoft AD and creating users through the administrative interfaces, the user will be created as enabled by default. In previous versions, it was only possible to update the user status after setting a (non-temporary) password to the user. This behavior was not consistent with other built-in user storages as well as not consistent with other LDAP vendors supported by the LDAP provider. NEW CONDITIONAL AUTHENTICATORS CONDITION - SUB-FLOW EXECUTED AND CONDITION - CLIENT SCOPE The Condition - sub-flow executed and Condition - client scope are new conditional authenticators in Keycloak. The condition Condition - sub-flow executed checks if a previous sub-flow was executed (or not executed) successfully during the authentication flow execution. The condition Condition - client scope checks if a configured client scope is present as a client scope of the client requesting authentication. For more details, see . DEFINING DEPENDENCIES BETWEEN PROVIDER FACTORIES When developing extensions for Keycloak, developers can now specify dependencies between provider factories classes by implementing the method dependsOn() in the ProviderFactory interface. See the Javadoc for a detailed description. DARK MODE ENABLED FOR THE WELCOME THEME We've now enabled dark mode support for all the keycloak themes. This feature was previously present in the admin console, account console and login, and is now also available on the welcome page. If a user indicates their preference through an operating system setting (e.g. light or dark mode) or a user agent setting, the theme will automatically follow these preferences. If you are using a custom theme that extends any of the keycloak themes and are not yet ready to support dark mode, or have styling conflicts that prevent you from implementing dark mode, you can disable support by adding the following property to your theme: darkMode=false Alternatively, you can disable dark mode support for the built-in Keycloak themes on a per-realm basis by turning off the Dark mode setting under the Theme tab in the realm settings. METRICS ON PASSWORD HASHING There is a new metric available counting how many password validations were performed by Keycloak. This allows you to better assess where CPU resources are used, and can feed into your sizing calculations. See and for more details. SIGN OUT ALL ACTIVE SESSIONS IN ADMIN CONSOLE NOW EFFECTIVELY REMOVES ALL SESSIONS In previous versions, clicking on Sign out all active sessions in the admin console resulted in the removal of regular sessions only. Offline sessions would still be displayed despite being effectively invalidated. This has been changed. Now all sessions, regular and offline, are removed when signing out of all active sessions. DEDICATED RELEASE CYCLE FOR THE NODE.JS ADAPTER AND JAVASCRIPT ADAPTER From this release onwards, the Keycloak JavaScript adapter and Keycloak Node.js adapter will have a release cycle independent of the Keycloak server release cycle. The 26.1.0 release may be the last one where these adapters are released together with the Keycloak server, but from now on, these adapters may be released at a different time than the Keycloak server. UPDATES IN QUICKSTARTS The Keycloak quickstarts are now using main as the base branch. The latest branch, used previously, is removed. The main branch depends on the last released version of the Keycloak server, Keycloak client libraries, and adapters. As a result, contributions to the quickstarts are immediately visible to quickstart consumers with no need to wait for the next Keycloak server release. UPDATED FORMAT OF KEYCLOAK_SESSION COOKIE AND AUTH_SESSION_ID COOKIE The format of KEYCLOAK_SESSION cookie was slightly updated to not contain any private data in plain text. Until now, the format of the cookie was realmName/userId/userSessionId. Now the cookie contains user session ID, which is hashed by SHA-256 and URL encoded. The format of AUTH_SESSION_ID cookie was updated to include a signature of the auth session id to ensure its integrity through signature verification. The new format is base64(auth_session_id.auth_session_id_signature). With this update, the old format will no longer be accepted, meaning that old auth sessions will no longer be valid. This change has no impact on user sessions. These changes can affect you just in case when implementing your own providers and relying on the format of internal Keycloak cookies. REMOVAL OF ROBOTS.TXT FILE The robots.txt file, previously included by default, is now removed. The default robots.txt file blocked all crawling, which prevented the noindex/nofollow directives from being followed. The desired default behaviour is for Keycloak pages to not show up in search engine results and this is accomplished by the existing X-Robots-Tag header, which is set to none by default. The value of this header can be overridden per-realm if a different behaviour is needed. If you previously added a rule in your reverse proxy configuration for this, you can now remove it. IMPORTED KEY PROVIDERS CHECK AND PASSIVATE KEYS WITH AN EXPIRED CETIFICATE The key providers that allow to import externally generated keys (rsa and java-keystore factories) now check the validity of the associated certificate if present. Therefore a key with a certificate that is expired cannot be imported in Keycloak anymore. If the certificate expires at runtime, the key is converted into a passive key (enabled but not active). A passive key is not used for new tokens, but it is still valid for validating previous issued tokens. The default generated key providers generate a certificate valid for 10 years (the types that have or can have an associated certificate). Because of the long validity and the recommendation to rotate keys frequently, the generated providers do not perform this check. ADMIN EVENTS MIGHT INCLUDE NOW ADDITIONAL DETAILS ABOUT THE CONTEXT WHEN THE EVENT IS FIRED In this release, admin events might hold additional details about the context when the event is fired. When upgrading you should expect the database schema being updated to add a new column DETAILS_JSON to the ADMIN_EVENT_ENTITY table. OPENSHIFT V3 IDENTITY BROKERING REMOVED As OpenShift v3 reached end-of-life a while back, support for identity brokering with OpenShift v3 has been removed from Keycloak. UPGRADING Before upgrading refer to for a complete list of changes. ALL RESOLVED ISSUES NEW FEATURES * Allow more extensive Override of BackchannelAuthenticationCallbackEndpoint core * Use optional realm attribute for authenticationrequest parameter max size/number validation configuration * Support dark mode, at least for the login pages login/ui * Operator support for setting default value of `http-pool-max-threads` operator * Used encrypted JGroups connection by default in Operator deployments operator * JDBC_PING2 as default discovery protocol * Option to specify trusted proxies dist/quarkus * Enabling authorization_details for client grant tokens until RAR is fully implemented * Provide missing user event metrics from aerogear/keycloak-metrics-spi to a keycloak mircometer event listener * Ability to specify log category levels through separate options dist/quarkus * Enhance WebAuthn registration to support custom FIDO2 origin validation * Ability to reject authentication to users without 2FA configured authentication * Allow users to specify the start page of a custom account-console theme account/ui * Authentication flow condition for client scope authentication ENHANCEMENTS * Align admin console for client for backchannel and frontchannel logout oidc * AuthenticationRequest add "create" prompt for sign-up oidc * js adapter just sets error to true upon error updateToken adapter/javascript * Additional authorization request parameters shouldn't be limited to 5 and shouldn't be discarded silently oidc * Support to enforce LoA in authentication flow for a client (Step-up) authentication * Allow custom message for brute force temporary lockout authentication * H2 Database should be opt-in and well-documented storage * Prevent "lost replace" in InfinispanAuthenticationSessionProvider storage * Maximum 100 resources with same URI checked when requesting permissions by URI authorization-services * Allow to restrict ProviderConfigProperty input to int values * Generalize or remove stack trace information found in error message exception handling * Keycloak native verification of an SD-JWT based vp_token oid4vc * Run tests with original `keycloak` login theme in nightly * Allow to create certificates for provider-keys authentication * OTEL: Add Keycloak CR support for Tracing options operator * OTEL: Apache HTTP client OpenTelemetry instrumentation * [Documentation] - Configuring trusted certificates - Fully specify truststore path dist/quarkus * OTEL: Instrument parts of Keycloak with OTEL spans * Clarify the behaviour of multiple Operator versions installed in the same cluster operator * Readonly profile attribute profile has unwanted not translated placeholder account/ui * [OID4VCI] Migrate Verifiable Credential Definitions from Client Attributes to Realm Level Attributes oid4vc * Explicitly document that the Operator does not create an Ingress for Admin URL operator * Add ui to override patternfly colors and logo * Better logging when error happens during transaction commit storage * Consolidate the logic for determining a local address core * Remove retry in LoginPage.resetPassword testsuite * Add CopyToClipboardButton to UserID in Admin UI * Expose membership type in the Admin UI for organization members admin/ui * Add an example nginx reverse proxy configuration * Show User Events on dedicated tab on Client-/User-Details * Add a reference to http-enabled in TLS/SSL setup * Upgrade Infinispan to 15.0.10.Final * Utilise `jdbc-ping` TCP based JGroups stack as default for non-operator Keycloak deployments * Make createWebAuthnRegistrationManager protected to allow cutomizations in subclasses authentication/webauthn * Prevent Keycloak from starting with wrong `work` cache configuration * Create a new base login theme * Add switch to disable dark mode * Background SQL statements show without a connected trace dist/quarkus * Enable virtual threads in Infinispan and JGroups by default * Update KEYCLOAK_SESSION cookie to not have sessionId in plain-text authentication * Sign the AUTH_SESSION_ID cookie value authentication * Username Form should support autocomplete login/ui * Standardize error messages from client and server in login theme (keycloak.v2) login/ui * Deprecate other transport stacks (ec2, azure, google) * Add JDBC_PING2 stacks for both TCP and UDP * Keycloak-admin-client should work with the future versions of Keycloak server admin/client-java * Update the Keycloak CPU and Memory sizing guide to reflect the new ec2 workder nodes * Delete Openshift 3.x identity provider * Support for the Croatian language * Remove remaining table USERNAME_LOGIN_FAILURE from the jpa UserSessionProvider times * Make the organization chapter of Server Admin guide available on downstream * Some dynamic imported functions are also statically imported making bundling them in-efficient * Improve build time of the js module * Add ability to enable support for Verifiable Credentials per Realm account/ui * Make cache-remote-host available when feature multi-site or cache-embedded-remote-store is enabled * Make documentation more clear that keycloak javascript adapter and node.js adapter are OIDC docs * Microsoft login - add prompt param configure * Avoid multi-release and java16 specific sources in the core module oidc * Update certain email templates for password recovery to match English translation format * Document network ports for Keycloak clustering * [Operator] Enhance the Keycloak Operator with Network Policies operator * Allow custom OIDCIdentityProvider implementations to specfiy the supported token types identity-brokering * OTEL: Provide Tracing SPI * Disable trim_trailing_whitespace in editorconfig to reduce noise in PRs * Improving the error message when failing to query an LDAP provider ldap * Allow a request object by considering a clock skew for smooth interoperability oidc * Allow a JWT client assertion by considering a clock skew for smooth interoperability oidc * Too many exceptions created when validating user profile * Avoid throwing exceptions when issuing reflection on user model * Add conditional text to Installation Locations * Update Leveraging JaKarta EE in Server Development guide * Feature: Allow disabling XA enforcement introduced with v26 dist/quarkus * Edits to Authorization Services guide * Allow a DPoP Proof by considering a clock skew for smooth interoperability * Addresse QE comments on Server Administration guide * Upgrade to ISPN 15.0.11.Final * Authorization Code Binding to a DPoP Key and DPoP with Pushed Authorization Requests oidc * Expose templateName in attributes when rendering freemarker templates login/ui * Upgrade to Quarkus 3.15.2 dist/quarkus * Prefer usage of StandardCharsets.UTF_8 over "UTF-8" charset reference core * [LoginUI] Set HTML lang attribute to "en" when internationalization disabled account/ui * Improve test method signature and gather more info about assertions testsuite * Resolve scopes from authenticated client sessions when selecting attributes * Allow configuring retries for JavaScript tests using environment variable ci * Allow asking for additional scopes when querying the account console root URL * Add WHY issues are important for each PR no matter how small to CONTRIBUTING.md docs * CONTRIBUTING.md has confusing ordered list with two times point 5 * Updated tested PostgreSQL version to 17 * Updated tested MariaDB version to 11.4 * Updated tested MySQL version to 8.4 * Consistent use of log.debugf to avoid generating too much GC overhead * Add a page with an index that links to smaller pages (JVM, HTTP, Database, embedded caches, external Infinispan) - we can show example widgets from the dashboards later * OTEL: Enhance traces with spans for each RestEASY resource * OTEL: Show spans in transaction completion at the end of a request * OTEL: Group persistent session work activities in parent span or link them * Avoid creating ObjectMapper but using JsonSerialization utility class when managing event details * Add password validation to update-password * Support for multiple values of some parameters in the grant SPI oidc * Update the Enabling Keycloak Event Metrics guide with the list of possible events and errors * Update release notes for Keycloak 26.1.0 with new community additions docs * [Operator] Network Policy Rules operator * Removing unnecessary configuration from auth servers * Update the sizing guide with an indicator on which user events to use * Reduce debounce time in RealmSelector * Replace `uuid` module with `crypto.randomUUID()` * Set the LDAP connection pooling protocols by default to plain and tls * Document the performance numbers from the ARM based ROSA cluster runs * Add a test that the metrics listed in the docs are available from Keycloak (keep it simple, ignore metrics that don't show up right after the start) * Use MeterProvider as suggested by the Micrometer team to avoid GC overhead * Enable LDAP Connection pooling by default * Release note about node.js adapter and javascript adapter released independently of keycloak server docs * Update upgrading notes with the changes related to core clients docs * Rescue dutch translations from aborted Weblate PR * Update the CA translation translations * Tune caching guide list of stacks for the upcoming release * Align realm name placeholder in the docs docs * Add metric for number of password validations * OTEL: Add tracing for credential validation * Suggestion: Improve Regex for NPM Version Conversion in set-version.sh ci * Allow tracing packets sent to and from LDAP for troubleshooting purposes * Help texts in the admin UI should end with a dot admin/ui * OTEL: merge Operator tracing test cases * Rename `org.keycloak.test.framework` package to `org.keycloak.testframework` test-framework * Rename `org.keycloak.test` package to `org.keycloak.tests` test-framework * Make @EnableFeature to handle the case with added provider of currently non-used SPI testsuite * Prepare a new guide for Keycloak's own metrics in the observability guide BUGS * keycloak.js example from the documentation leads to error path adapter/javascript * Locale Setting for Update Password Mail admin/api * Race when creating client protocol mappers (ClientManager#enableServiceAccount) resulting in duplicate entries storage * Incorrect get the members of a group imported from LDAP ldap * IllegalArgumentException on canceled Account Linking oidc * Step-up authentication with existing cookie not working when using `Authentication Flow Overrides` per client authentication * Broken Promise implementation for AuthZ JS adapter/javascript * Backchannel Logout silently not sent, if Frontchannel Logout is enabled as well oidc * oidc - JavaScript-Adapter LocalStorage#clearExpired does not clear all possible items adapter/javascript * Documentation - Expand/Clarify Admin REST API User Search Functionality admin/api * the InfoPage after an ExecuteActionsEmail is not localized based on the user's locale authentication * robots.txt causes indexing authentication/webauthn * Incorrect ldap-group-mapper chosen to sync changes to ActiveDirectory when several mappers with varying group paths used ldap * Uncaught (in promise): QuotaExceededError adapter/javascript * Issue with concurrent user & group delete, unable to cleanup resource server user-policy & group-policy authorization-services * Members are inhereted from LDAP group with the same name ldap * When using `oidcProvider` config url (.well-known) it's not possible to use `silentCheckSsoRedirectUri` adapter/javascript * JavascriptAdapterTest errors when running with strict cookies on Firefox ci * Broken (read-only) database connections not getting removed from connection pool, keycloak claims to be healthy. storage * Inconsistent TypeScript definitions in the module @keycloak/keycloak-admin-client while compiling admin/client-js * Workflow error: Base IT - RefreshTokenTest#refreshTokenWithDifferentIssuer testsuite * Allow increasing wait time on each failure after the max number of failures is reached authentication * update brute force docs to reflect available lockouts modes (temporary / permanent / mixed) authentication * Social login - Stack Overflow test fails ci * NPE on External OIDC to Internal Token Exchange when Transient Users feature is enabled token-exchange * Declining terms and conditions in account-console results in error account/ui * some GUI validation check missing admin/ui * Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#createRemoveClient ci * Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#createClient ci * Unstable test KerberosStandaloneCrossRealmTrustTest.test03SpnegoLoginWithCorrectKerberosPrincipalRealm ci * When the Delete Credential required action is set to false an authentication application cannot be removed from the account UI core * Make sure it is not possible to run snapshot server against production DB by default core * Event type not set in reset-credential flow under some conditions resulting in an error page authentication * Upgrade to 25 throws: Statement violates GTID consistency core * Organization API not available from OpenAPI documentation admin/api * Workflow failure: WebAuthn IT (firefox) - WebAuthnSigningInTest:navigateBeforeTest ci * Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently ci * token exchange: exchange-sequence still fails with `Client session for client '..' not present in user session` when starting on public client token-exchange * Offline sessions are not removed from admin console after sign out all active sessions core * Selection list does not close after outside click admin/ui * Enabling/Disabling user does not work with Microsoft AD LDAP via Admin API/UI ldap * Show account page before login core * Misleading docs and functionality around cache-ispn.xml dist/quarkus * Error when non-admin user accesses admin console admin/fine-grained-permissions * Logout not working after removing Identity Provider of user identity-brokering * KC doesn't enforce uniqueness of aliases in Authentication flows, but uses them as identifiers (in config export) authentication * Windows builds fail too often due to problems with the download of Node ci * Repeated email verifications while logging in through IDP caused by email case sensitivity authentication * UserId too long to add Security Key WebauthN authentication/webauthn * LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and user already exists ldap * High CPU usage on logout when using remote Infinispan only setup infinispan * none of the enabled features are shown as such in the admin console docs * creating short admin password in BCFIPS approved mode gives "Internal server error" page core * "Cookie not found" in multi-step auth flows / mobile browsers core * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginAgainWithoutRememberMe ci * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginMissingUsername ci * addExecutionFlow endpoint does not return right ID admin/api * Nightly Cypress tests for the Admin Console are failing on Firefox admin/ui * RP-Initiated logout using `POST` method fails in cross-origin setup oidc * Requesting `offline_access` without an established session results in two sessions oidc * Authentication sessions do not handle concurrent writes core * Flaky test: org.keycloak.testsuite.forms.BrowserButtonsTest#appInitiatedRegistrationWithBackButton ci * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginWithRememberMe ci * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginRememberMeExpiredMaxLifespan ci * Organization Domain not marked as a required field in the Admin UI admin/ui * Requested `grant_types` inconsistent with created `grant_types` for OpenID Connect Dynamic Client Registration oidc * Login V2: Missing "dir" attributes login/ui * Admin UI defaults to master realm even without permissions to it admin/ui * Consider Replacing Monaco Editor or Bundling Resources Locally to Avoid CSP Conflicts admin/ui * Possible issue with unavailable CryptoIntegration when using keycloak-authz-client with private_key_jwt and ECDSA algorithm oidc * Role descriptions do not wrap in the UI admin/ui * Incorrect Disclosure Handling in SdJwtVP.of(String) Method oid4vc * RESTART_AUTHENTICATION_ERROR in Iphone devices (using safari and chrome browser) oidc * Passkeys: Infinite (re-)loading loop on browsers with WebAuthn Conditional UI disabled authentication/webauthn * Duplicate principals not allowed in keystore authentication * Flaky test: org.keycloak.testsuite.forms.LoginTest#loginWithEmailUserAndRememberMe ci * Any one Client role mapping to user/group generating two events on admin events tab. core * 400 error logged as 500 identity-brokering * Icons for social providers broken in login screen if the provider is created with non-default alias admin/ui * Admin UI e is undefined if required action recreated with own alias admin/ui * Double scroll bar due to warning banner admin/ui * Wrong translation issues in greek translation translations * Permission cannot be evaluated when only role and client are provided authorization-services * Link to existing account form: IDP Alias displayed instead of IDP Display Name login/ui * 404 in admin console when unlinking managed user from organizations admin/ui * Flaky test: org.keycloak.testsuite.forms.LevelOfAssuranceFlowTest#testWithOTPAndRecoveryCodesAtLevel2 ci * Can get authorization code on a non verified user with some specific kc_action (AIA) oidc * Previously entered translations should persist in the translation dialog for the attribute groups admin/ui * Keycloak In Docker: ERROR: Strict hostname resolution configured but no hostname setting provided docs * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * Unable to submit forms in Safari account/ui * Broken links / anchors after KC26 release docs * In imported realms, the ability to use environment variables has disappeared import-export * Fix runaway asterisk formatting in TLS documentation docs * Cleanup how static state is set for import / export dist/quarkus * Upgrade Selenium testsuite * Repeated "to a" in the help text for the "User Attribute" mapper admin/ui * Fix v2 login layout login/ui * Client Secret Required Bug When Using "JWT Signed with Private Key" for (Keycloak/) OpenID Connect Provider admin/ui * No message for `policyGroupsHelp` admin/ui * ClassNotFoundException OracleXADataSource/OracleDataSource using IDELauncher with Keycloak 26.0.0 dist/quarkus * Non-optimized start command gives erroneous warnings for runtime spi options dist/quarkus * Customizable footer (Keycloak 26) not displaying in keycloak.v2 login theme login/ui * RTL not working on keycloak.v2 login template login/ui * Validation of http truststore or keystore file masks if the file exists dist/quarkus * Test "Duplicate Group" unstable in Admin UI / job is failing admin/ui * Failure to redirect to organization IdP when the organization scope is included organizations * Not possible to configure custom client authenticator in Admin UI authentication * Client Scope updates are not replicated on a distributed keycloak setup in kubernetes admin/api * Client Policy throws "Invalid Redirect Uri" if Standard Flow is disabled oidc * Organizations section is shown in account console if organizations is not enabled for a realm. account/ui * Aurora IT tests failing periodically with download of node ci * Admin client returns HTTP code `400 Bad Request` when using x509 certificate admin/client-java * [Regression] 26.0.0 return empty "access: []" JWT for Docker-v2 Auth provider, resulting in "access denied" authentication * Error when adding or removing a user from an organisation when there are 2 or more Keycloak servers in a cluster organizations * Upgrade to 26 fails with 'ERROR: index "idx_us_sess_id_on_cl_sess" does not exist' core * FOUC in Firefox on login UI login/ui * CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus * Stabilise my-resources.spec test account/ui * NPE when device representation cannot be parsed authentication * NEP when Default Role is not present on CachedRealm infinispan * client-jwt ES256 error when doing CODE_TO_TOKEN oidc * Wrong documentation link in keycloak-js readme docs * [Keycloak CI] - AuroraDB IT - Error creating EC2 runner instance * [Keycloak CI] - FIPS IT - Failed to fetch maven * Auth not possible for auth session where user was enabled in the meantime authentication * Not persisted config settings prevent server start dist/quarkus * NPE thrown in whoami endpoint admin/ui * Recovery authentication codes are numbered inconsistently login/ui * ResetPasswordTest.resetPasswordExpiredCode Error -> AbstractKeycloakTest.deleteAllCookiesForRealm:297 core * Cannot install latest version (26.0.0) of the adapter using Galleon adapter/jee * [PERF] OpenTelemetry is initialized even when disabled * password is a required field admin/ui * Not possible to close dialog boxes when clicking buttons or the close icon admin/ui * Windows kc.bat handling of serveral parameter types is not correct dist/quarkus * keycloak.v2 registration: Password policy validation error "errorList is null" login/ui * Doc CI - broken links error docs * Handle removal of online session for the directGrant and clientCredentials * Handle removal of online session for authorization_code when `scope=offline_access`is used oidc * grammatical error in "Managing Organizations" documentation docs * Add More Info to Organization Events organizations * Home URL for security-admin-console is broken admin/ui * [Admin UI] Broken autocomplete input on the "Create resource-based permission" form admin/ui * Flaky Test ResetPasswordTest.resetPasswordLoggedUser:188->openResetPasswordUrlAndDoFlow:252 testsuite * Custom keycloak login theme styles.css return error 404 login/ui * [Windows] Wrong expansion of ${kc.home.dir} causes NoSuchFile exception dist/quarkus * LDAP Pagination not working for role membership in GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE strategy ldap * Org Invite: `linkExpiration` template variable represents 54 years in minutes organizations * Listing federated LDAP users is very slow with import enabled ldap * Onclick focus issue in the Username field of Clients / / Client Scopes / Evaluate admin/ui * Respect the locale set to a user when redering verify email pages user-profile * Users without `view-realm` can't see user lockout state in Admin UI admin/ui * Do not show domain match message in the identity-first login when no login hint is provided organizations * The Realm Selection Dropdown Breaks After 50 Realms In Database admin/ui * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * java.util.ConcurrentModificationException when process user sessions update infinispan * Keycloak 26.0.0/26.0.1 Import Issue: Multiple Realms Not Imported, Duplicated Realm Imported Instead import-export * Group select dialog: Subgroups not displayed initially due to pagination admin/ui * JS password validation doesn't work as intended with uppercase and lowercase minimum requirements login/ui * cli options starting or ending with ; or containing ;; mangle the cli handling dist/quarkus * Grant type "urn:ietf:params:oauth:grant-type:uma-ticket" token service endpoint returns NullPointerException authorization-services * OIDC IdP Unable to validate signatures using validatingPublicKey certificate admin/ui * logout with client_id and/or post_logout_redirect_uri results in bad request on logout confirmation page oidc * Deleting a user leads to ISPN marshalling exception * Group search in user view doesn't work as expected for nested groups admin/ui * Service accounts visible under user search in Admin console admin/api * Docs: Dead link docs * Flaky Test: BrowserFlowTest.testAlternativeNonInteractiveExecutorInSubflow() testsuite * PEM files distributed as part of SAML adapter configs are missing -----BEGIN and -----END blocks saml * NullPointerException in ConditionalOtpFormAuthenticator.java authentication * Remove inaccurate statement about master realm imports docs * Fix DB overflow for EVENT_ENTITY table and SESSION_ID column in case that incorrect data are sent core * NPE in Organization(s)Resource when using Quarkus Rest Client admin/api * ParEndpoint#request corrupts values added in request object oidc * Admin UI doesn't show realms when using login through identity provider admin/fine-grained-permissions * Incorrect Content-Type Expectation for POST /admin/realms/{realm}/organizations/{id}/members in Keycloak API admin/api * [Keycloak 26.0.2] Getting "Forbidden, permission needed: query-clients" as temp-admin admin/ui * LDAP: searching users with import disabled is slower since fix for 34050 ldap * Flaky test: org.keycloak.testsuite.broker.KcSamlBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * [Trivy] - Workflow failure ci * NullPointerException in RoleResolveUtil when admin-cli uses lightweight token admin/cli * [26.0.2] Migration from 25.0.1 Identity Provider Errors identity-brokering * kc.config.args exposed in show-config dist/quarkus * Missing help icons in Webauthn Policy and Webauthn Passwordless Policy missing in admin ui admin/ui * Do not rely on the `pwdLastSet` attribute when updating AD entries ldap * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * Username and password should be optional for multi-site deployment infinispan * Clicking on link to Keycloak documentation from Keycloak admin UI does nothing instead of opening documentation admin/ui * Flaky test: org.keycloak.testsuite.actions.TermsAndConditionsTest#termsDeclined ci * Renaming realm in UI broken admin/api * Non compliant OpenID Client Authentication when `client_secret_jwt` with PAR (Pushed Authorization Requests) oidc * Quarkus dev mode does not work dist/quarkus * Flaky test: org.keycloak.testsuite.forms.ResetPasswordTest#resetPasswordLinkTestAppWithoutRedirectUriParam ci * Switching 'Email as Username' alters existing custom usernames to email addresses, causing LDAP sync issues core * Text in "Choose a policy type" is not wrapping admin/ui * Attributes missing in OrganizationRepresentation when using Admin REST API in Keycloak 26 admin/api * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci * Rework global event listener for metrics core * NPE in InfinispanOrganizationProvider if userCache is disabled infinispan * Error on testsuite "group_test" on Cypress admin/ui * AdminEventQueryTest test fails after adding global event listener core * Remove duplicate lines in userprofile freemarker template login/ui * Fix typo in log message account/ui * Securing apps guide breaks downstream docs * Missing downstream explicit name for anchors docs * Feature in higher version takes precedence even if it has lower type order * Client Protocol Mappers with non UUID ids cannot be edited admin/ui * KC_CACHE_EMBEDDED_MTLS_ENABLED is ignored infinispan * Continuous reload when KC_AUTH_SESSION_HASH expires authentication * `ClientConnection.getRemoteAddr` can return a hostname when behind a reverse proxy core * Keys tab showing disabled and inactive keys as active admin/ui * [Admin UI] [Create resource-based permission] Resource input is disabled admin/ui * New credential templates broken in KC26 login/ui * calling openid-connect/auth with previous version valid cookies generate internal server error authorization-services * Invalid flag for addDefaultRequiredActions infinispan * GroupMappersTest test fails in keycloak-client core * CVE-2024-10973 - Cleartext Transmission of Sensitive Information in org.keycloak:keycloak-quarkus-server * AdminUI: Alphabetically sort "Event saved type" in the events listing admin/ui * Log handler specific log levels support only lower-case levels dist/quarkus * Liquibase outputs update summary directly to standard out dist/quarkus * [Keycloak CI] - Base IT - KerberosLdapCrossRealmTrustTest.test03SpnegoLoginUsernamePassword ldap * [Jenkins Keycloak CI] - Cookies Tests - KcOidcBrokerPrivateKeyJwtCustomAudienceTest ci * [Jenkins Keycloak CI] - Cookies Tests - KcSamlBrokerTest * [Jenkins Keycloak CI] - Cookies Tests - KcOidcBrokerLdapTest ci * Keycloak needs to return "invalid_request" from Token Endpoint if a token or refresh request lacks DPOP proof oidc * [Keycloak CI] - Quarkus IT - StartCommandDistTest and BuildAndStartDistTest dist/quarkus * [Jenkins Keycloak CI] - Adapter Cookies Tests - Failures with Firefox strict cookies ci * Deprecated CLI options and new options are not stable in their sorting dist/quarkus * On logout from admin console, a serverinfo call with 401 response in the logs admin/ui * Clients invalidated on each client credential grant core * Incomplete registration form when edit email is disabled and email is set as username user-profile * Authentication Link and IDP Fails with 400 Bad Request After Migrating to Version 26 and Delete Authentification authentication * Upgrade 24 to 25 fails because db jpa changes drop nonexisting indexes. core * [Keycloak CI] Outdated surefire artifacts names - Quarkus IT and UT ci * Update Email doesn't update username when Email as Username and Attributes are enabled user-profile * Adding "sub" claim to lightweight access token causes HTTP 403 Forbidden Error in Keycloak 26.0.5 oidc * Unable to scroll/swipe through the main menu on macOS admin/ui * ES256 key continue to be used to sign token even after expiry oidc * getAll() organization members only returns the first 10 members organizations * KC25 Migration guide for caching options needs clarification * MySQL database migration issue core * Mis-formatted unordered list in the caching docs * Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsRemoval ci * PersistentSessionsWorker: retry with 0 backoff ms. core * Filter events by user id and client not working admin/ui * `organizationEnabled` and `verifiableCredentialsEnabled` attributes are present as attributes in an export * Cannot request additional scopes when using the account console account/api * Flaky test: org.keycloak.testsuite.broker.KcSamlBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled core * Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsCreation ci * Flaky test: org.keycloak.testsuite.adapter.servlet.SAMLClockSkewAdapterTest#testTokenTimeIsValid ci * CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process * CVE-2024-10270 Potential Denial of Service * CVE-2024-10492 Keycloak path trasversal * CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability * CVE-2024-10039 Bypassing mTLS validation * Account UI E2E / `personal-info/personal-info.spec.ts` is unstable ci * Typo www.recatcha.net -> www.recaptcha.net in docs docs * Fix typo in v24 changelog: "longer" -> "no longer" docs * reCAPTCHA v3 not working login/ui * Links to guides in Observability section are still pointing to server section docs * Typos in `.md` and `.adoc` files, detected using codespell and manual review docs * Edit Help Mode descriptor for Roles in policy form admin/ui * Your login attempt timed out authentication * Upgrade 26.0.5 -> 26.0.6 completely breaks admin events in the admin UI admin/ui * Maven clean shouldn't be skipped by default on Windows * Database migration fails after upgrading operator to v26.0.6 core * Token issuer is null in executeActionsEmail and sendVerifyEmail if no clientId is passed admin/api * Strange Random behavior - Intermittent missing organization claim in Keycloak JWT token organizations * Error when creating a permission ticket when there are 2 or more Keycloak servers in a cluster authorization-services * Errors in persian and tukish translations in account translations * Multiselect Checkboxes in user profile don't allow to unset value user-profile * Resolve scopes from bearer tokens when processing requests to the Account API * log-syslog-max-length is ignored dist/quarkus * [Keycloak CI] - Quarkus UT (windows-latest) - Keycloak Quarkus Server Deployment ci * SAML Adapter Galleon Pack for EAP8 cannot use new metadata options for layers adapter/saml * Capitalization in Hungarian translation needs improvement translations * Mis-formatted definition list of hashing algorithms * Showing LDAP error message when failing to reset password ldap * OTEL: OTelTracingProvider should be request-scoped dist/quarkus * access token or refresh token will be reset when another is set admin/ui * Flaky test: org.keycloak.testsuite.model.DBLockTest.testTwoLocksCurrently ci * Update Infinispan examples in the High Availability guide docs * Delete user confirm title is wrong admin/ui * Events: Wrong text for user id search admin/ui * Event Representation is not shown for Admin Events in UI admin/ui * When using the token revocation endpoint with refresh-token, all sessions from the user+client are terminated oidc * [Jekins Keycloak CI] - RH-SSO EAP adapters remote saml tests ci * `QuarkusPropertiesDistTest` fails on Windows testsuite * Initial keycloak bootstrap suggestion is not correct. dist/quarkus * IPA-Tuura federation: password field shows password in plaintext core * Upgrading guide 26.0.6 is missing in the built document docs * JVM crash when running base testsuite test from command line using auth-server-quarkus-embedded dist/quarkus * Invoking `BaseUpdater.markDeleted()` more than once cause the transient status to be lost infinispan * Embedded test server fails when running from `mvn` dist/quarkus * Code quote for http-enabled is incorrect, missing relevant option in reverse proxy documentation docs * Fix broken Dependabot configuration * Temporary password toggle in set password dialog is cut off in admin-console admin/ui * Inconsistency when returning user attributes when executing a seach or fetching users by ID from external user storage providers ldap * Improve sssd note about synchronization of groups docs * realm_test.spec fails on firefox admin/ui * New install doesn't allow admin user creation dist/quarkus * token exchange response expires_in inconsistent behavior token-exchange * Support for X-Forwarded-Prefix should not be implied docs * POST create client with id exceed 36 characters length response status 500 instead of 403 admin/api * Missing userId in LOGIN_ERROR event for permanent lockout authentication * GET .../organizations/{id}/members/{id} multiple ids organizations * Event for setting up recovery codes authentication * Fix grammar in documentation page docs * Typo in using custom Keycloak image for Operator guide docs * Quarkus.properties should not use -cf or --config-file flag docs * Update to KC 26.x from core * Keycloak incorrect usage of UserPolicy and cache. authorization-services * Keycloak arquillian testsuite not working with the default profile testsuite * Token revocation may not correctly revoke related access tokens * Exact searches should be the default when querying user by attributes admin/api * Regression Mysql 8 support as the upgrade script do not use temporary table storage * Selected Organization not present in access_token of different client within same Realm if user belongs to multiple organization organizations * Unused LDAP provider options are still exposed * Selecting one role selects all admin/ui * MapComponent UI Not Displaying Saved Values in Keycloak React Admin UI admin/ui * Typo in username pt_BR translation in account console account/ui * Failing since may be reported incorrectly on health probe dist/quarkus * Map Configuration Property in Custom UserStorageProviderFactory Not Displayed in UI After Saving admin/ui * Organization Scope mismatch organizations * Duplicate entry in admin message properties admin/ui * Broken links in getting-started guide pointing to quickstarts latest branch docs * Flaky test: org.keycloak.testsuite.forms.BruteForceTest#testExceedMaxTemporaryLockouts ci * Wrong content-type for content.json account/ui * Unable to use custom handlers for HTTP OPTIONS method in subresources dist/quarkus * Double submit on otp form causes error login/ui * Translations specified in the admin console do not override the translations specified in a theme translations * Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTokenExchangeTest#testInternalExternalTokenExchangeStoredToken ci * IDPs can not be found anymore by "Issuer" value when exchanging tokens identity-brokering * Unnecessary text in documentation docs * NPE when Kerberos Server is unreachable core * Incompatible method of admin-client in Keycloak 26.1 and missing javadoc admin/client-java * max-count for session caches is not set by default for local Infinispan config dist/quarkus * Issue with "403 Forbidden" Access /admin/realms/{realm}/authentication/executions/{executionId} admin/api * Fix invalid url in keycloak.js log message adapter/javascript * "Remove role" alert text is wrong admin/ui * Profile attribute inputs incorrectly marked as required when minimum length is configured admin/ui * Error when re-authenticating when organization is enabled organizations * PasswordAgePolicy triggering NullPointerException when credentail does not have createdDate core * KeycloakServer application not working anymore testsuite * PersistentSessionsWorker: Cannot access delegate without a transaction ldap * Roll-back change to startup timeout operator * [Keycloak CI] - Bse IT/Store IT - IdentityProviderTest ci * CVE-2024-11736 Unrestricted admin use of system and environment variables * CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers * Metric `vendor_jgroups_*` is unstable and can change in upcoming releases infinispan * When running Keycloak in testutils with Undertow, the admin UI thows NoMessageBodyWriterFoundFailure admin/ui * Too much space around "Forgot Password" button (keycloak.v2) login/ui

13 Jan 2025 12:00am GMT

We're very excited to announce that Infinispan is . WHY JOIN A FOUNDATION? We want to make it clear that Infinispan's roadmap is independent of the company that has funded its development since day 1, and we welcome contributors to participate in what we think is a bright future for our project. In the same vein, we've also recently to a neutral platform. WHY COMMONHAUS? Commonhaus just ticks all the right boxes for us: its lightweight governance is ideal. We get all the benefits of being part of an awesome foundation, with all the benefits of running the project on our own terms. Commonhaus is also the home to a number of "friend projects": Hibernate, Quarkus, Debezium, Jackson all play a key role in our software and it's great that we share a "common home".

13 Jan 2025 12:00am GMT

The Model Context Protocol (MCP) is an emerging standard that enables AI models to safely interact with external tools and resources. In this tutorial, I'll show you how to implement an MCP server using Quarkus, allowing you to extend AI applications with custom tools powered by the Java ecosystem. WHAT WE'LL BE BUILDING We'll implement a simple MCP server that provides tools to get weather forecasts and alerts for US-based locations. We've chosen this example because it aligns with the official MCP quickstart guide at , making it easier to compare implementations across different languages. Our server will expose two tools: getAlerts and getForecast. Once built, we'll connect it to an MCP host that runs the server as a subprocess. Here's how it looks when integrated with Claude: CORE MCP CONCEPTS MCP servers can provide three main types of capabilities: Resources File-like data that can be read by clients (like API responses or file contents) Tools Functions that can be called by the LLM (with user approval) Prompts Pre-written templates that help users accomplish specific tasks This tutorial focuses on implementing tools. PREREQUISITES To follow this tutorial you need: * Familiarity with Quarkus and Java * Understanding of LLMs (OpenAI, Granite, Anthropic, Google, etc.) SYSTEM REQUIREMENTS * Quarkus CLI * JBang (optional) SET UP YOUR PROJECT First, create a new Quarkus project with rest-client, qute and mcp server extension without default boilerplate code: quarkus create app --no-code -x rest-client-jackson,qute,mcp-server-stdio weather We're using the stdio variant as it's required for MCP hosts that run the server as a subprocess. While an sse variant exists for Server-Sent Events streaming, we'll focus on the standard input/output approach. BUILDING THE SERVER Create a new file src/main/java/org/acme/Weather.java. The complete code for this example is available . WEATHER API INTEGRATION First, let's set up the REST client for the weather API: @RegisterRestClient(baseUri = "https://api.weather.gov") public interface WeatherClient { // Get active alerts for a specific state @GET @Path("/alerts/active/area/{state}") Alerts getAlerts(@RestPath String state); // Get point metadata for coordinates @GET @Path("/points/{latitude},{longitude}") JsonObject getPoints(@RestPath double latitude, @RestPath double longitude); // Get detailed forecast using dynamically provided URL @GET @Path("/") Forecast getForecast(@Url String url); } To handle the API responses, we'll define some data classes. Note that we're only including the fields we need, as the complete API response contains much more data: static record Period( String name, int temperature, String temperatureUnit, String windSpeed, String windDirection, String detailedForecast) { } static record ForecastProperties( List periods) { } static record Forecast( ForecastProperties properties) { } Since the Weather API uses redirects, add this to your application.properties: quarkus.rest-client.follow-redirects=true FORMATTING HELPERS We'll use Qute templates to format the weather data: String formatForecast(Forecast forecast) { return forecast.properties().periods().stream().map(period -> { // Template for each forecast period return Qute.fmt( """ Temperature: {p.temperature}°{p.temperatureUnit} Wind: {p.windSpeed} {p.windDirection} Forecast: {p.detailedForecast} """, Map.of("p", period)).toString(); }).collect(Collectors.joining("\n---\n")); } IMPLEMENTING MCP TOOLS Now let's implement the actual MCP tools. The @Tool annotation from io.quarkiverse.mcp.server marks methods as available tools, while @ToolArg describes the parameters: @Tool(description = "Get weather alerts for a US state.") String getAlerts(@ToolArg(description = "Two-letter US state code (e.g. CA, NY)") String state) { return formatAlerts(weatherClient.getAlerts(state)); } @Tool(description = "Get weather forecast for a location.") String getForecast( @ToolArg(description = "Latitude of the location") double latitude, @ToolArg(description = "Longitude of the location") double longitude) { // First get the point metadata which contains the forecast URL var points = weatherClient.getPoints(latitude, longitude); // Extract the forecast URL using Qute template var url = Qute.fmt("{p.properties.forecast}", Map.of("p", points)); // Get and format the forecast return formatForecast(weatherClient.getForecast(url)); } The forecast API requires a two-step process where we first get point metadata and then use a URL from that response to fetch the actual forecast. RUNNING THE SERVER To simplify deployment and development, we'll package the server as an uber-jar. This makes it possible to mvn install and publish as a jar to a Maven repository which makes it easiier to share and run for us and others. quarkus.package.uber-jar=true Finally, we can optionally enable file logging as without it we would not be able to see any logs from the server as standard input/output is reserved for the MCP protocol. quarkus.log.file.enable=true quarkus.log.file.path=weather-quarkus.log After running mvn install, you can use JBang to run the server using its Maven coordinates: org.acme:weather:1.0.0-SNAPSHOT:runner or manually using java -jar target/weather-1.0.0-SNAPSHOT-runner.jar. INTEGRATION WITH CLAUDE DESKTOP Add this to your claude_desktop_config.json: { "mcpServers": { "weather": { "command": "jbang", "args": ["--quiet", "org.acme:weather:1.0.0-SNAPSHOT:runner"] } } } The --quiet flag prevents JBang's output from interfering with the MCP protocol. You can also run the server directly without using java - then it would be something like java -jar /weather-1.0.0-SNAPSHOT-runner.jar. We use JBang here because simpler if you want to share with someone who does not want to build the MCP server locally. DEVELOPMENT TOOLS MCP INSPECTOR For development and testing, you can use the MCP Inspector tool: npx @modelcontextprotocol/inspector This starts a local web server where you can test your MCP server: INTEGRATION WITH LANGCHAIN4J Since version 0.23.0, Quarkus LangChain4j supports MCP, meaning it acts as an MCP client. For detailed information, see . To use our weather server with LangChain4j, add this configuration: quarkus.langchain4j.mcp.weather.transport-type=stdio quarkus.langchain4j.mcp.weather.command=jbang,--quiet,org.acme:weather:1.0.0-SNAPSHOT:runner OTHER CLIENTS/MCP HOSTS The Model Context Protocol has a page listing . While I have not tested all the various clients and MCP hosts, the similar approach of using jbang --quiet should work for most if not all of them. TESTING THE SERVER You can test the server through Claude or other MCP hosts with queries like: * "What is the weather forecast for Solvang?" * "What are the weather alerts for New York?" Here's what happens behind the scenes: 1. Your question goes to the LLM along with available tools information 2. The LLM analyzes the question and determines which tools to use 3. The client executes the selected tools via the MCP server 4. Results return to the LLM 5. The LLM formulates an answer using the tool results 6. You see the final response! CONCLUSION We've seen how Quarkus makes implementing an MCP server straightforward, requiring minimal boilerplate code compared to other implementations. The combination of Quarkus's extension system and JBang makes development and deployment quite a joy. FURTHER READING * * * *

13 Jan 2025 12:00am GMT

Byteman 4.0.24 is now available from the and from the . It is the latest update release for use on all JDK9+ runtimes up to and including JDK24 Byteman 4.0.24 is primarily a maintenance release which enables Byteman to be used with JDK24 releases. It also contains a small bug fix. More details are provided in the and the latest .

09 Jan 2025 2:14pm GMT

I'm pleased to announce that the new WildFly and WildFly Preview 35.0.0.Final releases are available for download at . NEW AND NOTABLE This quarter we had a heavy focus on MicroProfile, particularly , which I'm pleased to say WildFly 35 fully supports. Improvements in the MicroProfile area include: * WildFly now . * WildFly now . * Standard WildFly now . This was previously supported in WildFly Preview. * Standard WildFly now . This was previously supported in WildFly Preview. * Our MicroProfile Reactive Messaging subsystem has added OpenTelemetry tracing integration for and . There's plenty of new things beyond MicroProfile area as well, though: * WildFly Preview is a compatible implementation of the , which was released in November, independent of the work-in-progress EE 11 Platform and Web Profile specifications. WildFly Preview was one of the compatible implementations used to ratify the specification, and WildFly Preview 35 is also a compatible implementation, on both and . * WildFly now includes in the bin/systemd directory, replacing the old, unsupported docs/contrib/scripts/systemd files. The new units include support for a managed domain. * The jaxrs subsystem now . This feature allows the client to send a JSON http request with Content-Type "application/merge-patch+json", and the JSON content will be directly merged to the target resource. * We added to standard WildFly. This was previously ; now it is available in standard WildFly as well. This feature is provided at the . * WildFly Preview has a new , intended to give users greater control over the configuration of Vert.x instances running in the server. This feature is provided at the . * We added a new quickstart and a new guide. Another big thing that's new is, as I , WildFly now requires a minimum of Java SE 17, and thus no longer supports running on Java 11. SUPPORTED SPECIFICATIONS JAKARTA EE Standard WildFly 35 is a compatible implementation of the EE 10 as well as the and the . WildFly is EE 10 Platform, Web Profile and Core Profile compatible when running on Java SE 17 and Java SE 21. Evidence supporting our certification is available in the repository on GitHub: Specification Compatibility Evidence Jakarta EE 10 Full Platform Jakarta EE 10 Web Profile Jakarta EE 10 Core Profile MICROPROFILE Standard WildFly 35 supports , along with several other MicroProfile specifications that are not part of MicroProfile Platform. WildFly's MicroProfile support includes implementations of the following specifications in our "full" (e.g. standalone-full.xml) and "default" (e.g standalone.xml) configurations as well as our "microprofile" configurations (e.g. standalone-microprofile.xml): MicroProfile Technology WildFly Full/Default Configurations WildFly MicroProfile Configuration MicroProfile Config 3.1 X X MicroProfile Fault Tolerance 4.1  -  X MicroProfile Health 4.0  -  X MicroProfile JWT Authentication 2.1 X X MicroProfile LRA 2.0  -  X MicroProfile OpenAPI 4.0  -  X MicroProfile Reactive Messaging 3.0  -   -  MicroProfile Reactive Streams Operators 3.0  -   -  MicroProfile Rest Client 4.0 X X MicroProfile Telemetry 2.0  -  X for the above specifications that are part of MicroProfile 7.0 can be found in the WildFly Certifications repository on GitHub. WILDFLY PREVIEW AND EE 11 As I noted in the , beginning with that release we are using WildFly Preview to provide a look at what we're doing for Jakarta EE 11 support. The EE 11 Platform and Web Profile specifications won't go GA before later this year. But there are milestone, Release Candidate and Final releases of many EE 11 specs and implementations available, so we are providiong those in WildFly Preview. This means for a number of EE APIs, WildFly Preview no longer provides an EE 10 compatible implementation. However, for a number of specifications that are planning changes for EE 11 we are still offering the EE 10 variant. In future releases we'll shift those to the EE 11 variants. As I mentioned earlier, the did go GA in November and WildFly Preview 35 is a compatible implementation of that profile. Full details on the EE specification versions provided by WildFly Preview can be found in . JAVA SE SUPPORT Our recommendation is that you run WildFly 35 on Java SE 21, as that is the latest LTS JDK release where we have completed the full set of testing we like to do before recommending a particular SE version. WildFly 35 also is heavily tested and runs well on Java 17. Our recommendation of SE 21 over SE 17 is solely because as a general principle we recommend being on later LTS releases, not because of any problems with WildFly on SE 17. While we recommend using an LTS JDK release, I do believe WildFly runs well on SE 23. By runs well, I mean the main WildFly testsuite runs with no more than a few failures in areas not expected to be commonly used. We want developers who are trying to evaluate what a newer JVM means for their applications to be able to look to WildFly as a useful development platform. We've also had good results with tests on Linux of an EA release of SE 24 (Oracle 24-ea+15-1658). Please note that WildFly runs in classpath mode. INCOMPATIBLE CHANGES Beginning with the WildFly 35 release, standard WildFly no longer supports running in a Java SE 11 environment. Users should run WildFly 35 on SE 21 or SE 17. The default name of the bootable jar produced by has changed from a fixed name of server-bootable.jar to the dynamic name ${project.artifactId}-bootable.jar where project.artifactId is the maven artifact id of the module producing the jar. If this default value isn't wanted, . RELEASE NOTES The full WildFly 35 release notes are . Issues fixed in the underlying WildFly Core 27.0.0 release are listed in the . Please try it out and give us your feedback, in the , or . And, with that, I'm moving on to what I think will be a very busy WildFly 36! Best regards, Brian

09 Jan 2025 12:00am GMT

We are thrilled to announce that starting with version 0.23.0, the Quarkus LangChain4j project integrates calling tools using the . WHAT IS THE MODEL CONTEXT PROTOCOL? MCP is an open protocol that standardizes how applications provide context to LLMs. An MCP server is an application that can provide tools, resources (be it a set of static documents or dynamically accessed data, for example from a database), or pre-defined prompts that your AI-infused application can use when talking to LLMs. When you package such functionality into an MCP server, it can be plugged into and used by any LLM client toolkit that supports MCP, including Quarkus and LangChain4j. There is also already a growing ecosystem of reusable MCP servers that you can use out of the box, and Quarkus also offers the that allows you to create MCP servers, but in this article, we will focus on the client side. More on creating MCP servers later. In version 0.23.x, implements the client side of the MCP protocol to allow tool execution. Support for resources and prompts is planned for future releases. In this article, we will show you how to use Quarkus and LangChain4j to easily create an application that connects to an MCP server providing filesystem-related tools and exposes a chatbot that a user can use to interact with the local filesystem, that means read and write files as instructed by the user. There is no need to set up an MCP server separately, we will configure Quarkus to run one as a subprocess. As you will see, setting up MCP with Quarkus is extremely easy. To download the final project, visit the . That sample contains the final functionality developed in this article, plus some stuff on top, like a JavaScript-based UI. In this article, for simplicity, we will skip the creation of that UI, and we will only use the Dev UI chat page that comes bundled in Quarkus out of the box. PREREQUISITES * Apache Maven 3.9+ * The npm package manager installed on your machine CREATING A FILESYSTEM ASSISTANT PROJECT We will assume that you are using OpenAI as the LLM provider. If you are using a different provider, you will need to swap out the quarkus-langchain4j-openai extension and use something else. Start by generating a Quarkus project. If you are using the Quarkus CLI, you can do it like this: quarkus create app org.acme:filesystem-assistant:1.0-SNAPSHOT \ --extensions="langchain4j-openai,langchain4j-mcp,vertx-http" -S 3.17 If you prefer to use the web-based project generator, go to and select the same extensions. Whenever you run the application, make sure the QUARKUS_LANGCHAIN4J_OPENAI_API_KEY environment variable is set to your OpenAI API key. CREATE THE DIRECTORY TO BE USED BY THE AGENT Under the root directory of the Maven project, create a directory named playground. This will be the only directory that the agent will be allowed to interact with. Inside that directory, create any files that you want for testing. For example, create a file named playground/hello.txt with the following contents: Hello, world! CREATE THE AI SERVICE Next, we need to define an AI service that will define how the bot should behave. The interface will look like this: @RegisterAiService @SessionScoped public interface Bot { @SystemMessage(""" You have tools to interact with the local filesystem and the users will ask you to perform operations like reading and writing files. The only directory allowed to interact with is the 'playground' directory relative to the current working directory. If a user specifies a relative path to a file and it does not start with 'playground', prepend the 'playground' directory to the path. If the user asks, tell them you have access to a tool server via the Model Context Protocol (MCP) and that they can find more information about it on https://modelcontextprotocol.io/. """ ) String chat(@UserMessage String question); } Feel free to adjust the system message to your liking, but this one should be suitable to get the application working as expected. CONFIGURE THE MCP SERVER AND THE CONNECTION TO IT We will use MCP server that comes as an NPM package, this is why you need to have npm installed on your machine. It is assumed that you have the npm binary available on your PATH (the PATH variable that the Quarkus process sees). Starting the server and configuring the connection to it is extremely easy. We will simply tell Quarkus to start up a server-filesystem MCP server as a subprocess and then communicate with it over the stdio transport. All you need to do is to add two lines into your application.properties: quarkus.langchain4j.mcp.filesystem.transport-type=stdio quarkus.langchain4j.mcp.filesystem.command=npm,exec,@modelcontextprotocol/server-filesystem@0.6.2,playground With this configuration, Quarkus will know that it should create a MCP client that will be backed by a server that will be started by executing npm exec @modelcontextprotocol/server-filesystem@0.6.2 playground as a subprocess. The playground argument denotes the path to the directory that the agent will be allowed to interact with. The stdio transport means that the client will communicate with the server over standard input and output. When you configure one or more MCP connections this way, Quarkus also automatically generates a ToolProvider. Any AI service that does not explicitly specify a tool provider will be automatically wired up to this generated one, so you don't need to do anything else to make the MCP functionality available to the AI service. Optionally, if you want to see the actual traffic between the application and the MCP server, add these three additional lines to your application.properties: quarkus.langchain4j.mcp.filesystem.log-requests=true quarkus.langchain4j.mcp.filesystem.log-responses=true quarkus.log.category.\"dev.langchain4j\".level=DEBUG And that's all! Now, let's test it. TRY IT OUT Since we didn't create any UI for our application that a user could use, let's use the Dev UI that comes with Quarkus out of the box. With the application running in development mode, access in your browser and click the Chat link in the LangChain4j card (either that, or go to directly). Try a prompt to ask the agent to read a file that you created previously, such as: Read the contents of the file hello.txt. If all is set up correctly, the agent will respond with the contents of the file, like in this screenshot: The bot can also write files, so try a prompt such as: Write a Python script that prints "Hello, world!" and save it as hello.py. Then have a look into your playground directory, and you should see the new Python file there! CONCLUSION The Model Context Protocol allows you to easily integrate reusable sets of tools and resources to AI-infused applications in a portable way. With the Quarkus LangChain4j extension, you can instruct Quarkus to run a server locally as a subprocess, and configuring application to use it is just a matter of adding a few configuration properties. And that's not all. Stay tuned, because Quarkus also has an extension that allows you to create MCP servers! More about that soon. UPDATE: The post about the server side is now available: .

08 Jan 2025 12:00am GMT

We released Quarkus 3.17.6, a maintenance release for our 3.17 release train, and the first release for 2025. UPDATE To update to Quarkus 3.17, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.17. For more information about the adjustments you need to make to your applications, please refer to the . FULL CHANGELOG You can get the full changelog of on GitHub. COME JOIN US We value your feedback a lot so please report bugs, ask for improvements… Let's build something great together! If you are a Quarkus user or just curious, don't be shy and join our welcoming community: * provide feedback on ; * craft some code and ; * discuss with us on and on the ; * ask your questions on .

08 Jan 2025 12:00am GMT

is a free event for software developers to meet, share ideas and collaborate. Every year, thousands of developers of free and open source software from all over the world gather at the event. Those staying home will be able to watch the live stream of the talks and ask questions online. Members of the Keycloak project will be on-site like last year, and there will be talks from both the Keycloak community and the Keycloak team. See below for places to meet other Keycloak enthusiasts, and which talks will relate to Keycloak. We will update this post in the upcoming weeks when more details emerge. MEET-AND-GREET While FOSDEM is organized around talks, it is also a great place to meet people in real life that you previously knew only from online, and make new friends. With thousands of people at the event, it is good to have a place for a meet-and-greet. Cloud Native Computing Foundation (CNCF) Stand A lot of will have a stand at FOSDEM. With Keycloak being a CNCF project, we will be sharing a time slot at their stand. You'll be able to meet Keycloak maintainers at the CNCF stand on Saturday, February 1st, from 16:00-17:30 h. As our time slot might change, please come back here on the day of the event and double-check! Linux Foundation side event & drinks! (Sat Feb 01, 18:00-20:00 h) As part of the events happening around FOSDEM, also called , the Linux foundation invites you for a drink. . FOSDEM IS ALL ABOUT DEVROOMS! FOSDEM is a big event divided into smaller, single-track conferences with their own call for papers and organizers. Here a short list of those dev rooms that might be of interest for you if you are into Keycloak: (Sun Feb 02, 09:00-17:00 h) Identity and Access Management Devroom is related to operating systems' identity and access management in the free software and open source world. Expect talks about identity federation, integrating identity management into the operating system, Kerberos, and last but not the least OpenID Connect. There are several Keycloak talks happening in this dev room, so make sure to tune in! (Sat Feb 01, 10:30-19:00 h) The Security Devroom covers everything that is relevant to security in the free software and open source world. Talks cover topics like cryptography, supply chain, secure development and hardening. There ! (Sun Feb 02, 10:30-12:30 h) The Digital Wallets and Verifiable Credentials DevRoom is about digital wallets, verifiable credentials and the ecosystems emerging from these subjects, especially in the EU. No talk is related to Keycloak itself, still interesting for those who are following the 's activities around verifiable credentials. KEYCLOAK RELATED TALKS See below a list of all Keycloak related talks. When you watch them live, you will be able to ask questions in the chat. All talks will be recorded and will usually be available two to four days after the conference. * * * * * We hope to see a lot of you either online or on site in Brussels at FOSDEM!

08 Jan 2025 12:00am GMT