Keycloak Versions Save

Open Source Identity and Access Management For Modern Applications and Services

24.0.3

3 weeks ago

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Enhancements

  • #26695 Keycloak and MSAD: enabling account in MSAD does not propagate to Keycloak ldap

Bugs

  • #24201 Cannot disable LDAP-backed user if importEnabled=false ldap
  • #28100 Failed authentication: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.UserModel.getFederationLink()" because "this.delegate" is null identity-brokering
  • #28248 Update user makes User ID changes when federationLink and LDAP_ID is not set properly admin/api
  • #28335 The false option of the pkceMethod init parameter for the JavaScript adapter is ignored adapter/javascript
  • #28638 Missing permission to read configmaps in `keycloak-operator-role` operator

24.0.2

1 month ago

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Enhancements

  • #25057 Inconsistent behaviour on getting user permissions using authorization authorization-services
  • #27433 Clarify format of keys in `additionalOptions` field in the Keycloak CR docs
  • #27481 Edit High Availability guide
  • #27484 Edit 23.0 changes part of Upgrading Guide
  • #27632 Integrate downstream Upgrading Guide changes into upstream
  • #27696 Upgrade to Quarkus 3.8.2 dist/quarkus
  • #27867 Corrections to Securing Apps Guide
  • #27871 Upgrade to Infinispan 14.0.26 core
  • #27953 Address feedback to Keycloak Server guide docs
  • #27955 Address term Keycloak in Server Administration Guide docs
  • #28009 Address edits to the Operator Guide
  • #28033 Upgrade Infinispan to 14.0.27.Final
  • #28084 Upgrade to Quarkus 3.8.3 dist/quarkus

Bugs

  • #14501 Getting failed to initialize js message if consent is rejected by user account/ui
  • #15403 No email send on TOTP/Authenticator app removal core
  • #20637 Reset password flow fails with "Page has expired" error when Kerberos authentication is enabled in the browser flow authentication
  • #22644 Flaky test: org.keycloak.testsuite.forms.BrowserFlowTest#testAlternativeNonInteractiveExecutorInSubflow core
  • #23701 Attribute search does not work with federated users with ldap. admin/ui
  • #23980 Keycloak Operator fails to install realm authentication flow because "flow is null" import-export
  • #25490 Partial export/import is not mentioned in Keycloak's Server Administration Guide docs
  • #25687 A java.lang.NullPointerException occurs when sending a Multipart/form-data request to any file upload interface. admin/api
  • #26396 How do you update a custom user storage provider jar that includes a version number? dist/quarkus
  • #27117 user sessions not accessible in all cluster nodes infinispan
  • #27180 Grant type "urn:ietf:params:oauth:grant-type:uma-ticket" openid-connect/token service endpoint is returning refresh token with invalid Expiration authorization-services
  • #27228 Lowercased "terms_and_conditions" is not migrated in fed_user_required_action table core
  • #27245 Account console does not correctly treat link / unlink account account/ui
  • #27269 mvnw clean install -Pdistribution on Windows deletes necessary files during clean of org.keycloak:keycloak-admin-ui admin/ui
  • #27275 Invalidating offline token is not working from client sessions tab authentication
  • #27366 Social login - test failures with unexpected status code testsuite
  • #27483 Authz-client AuthorizationResource.getPermissions() ClassCastException authorization-services
  • #27504 Cpu and memory sizing typo docs
  • #27529 LegacyUserCredentialManager class not found storage
  • #27540 URL change for liquibase docs docs
  • #27548 Custom Browser Flow not working anymore admin/ui
  • #27573 Release notes from 24.0.0 miss that multi-site active-passive deployments are supported docs
  • #27597 dropping KC_PROXY=edge causes startup error core
  • #27611 Cannot modify realm email settings since keycloak 24 user-profile
  • #27653 Admin tests: Flaky realm_settings_user_profile_enabled test admin/ui
  • #27701 MTLS Cache options should be runtime options, not build time options dist/quarkus
  • #27719 Wrong Welcome page image in the documentation docs
  • #27745 Registration template in login2 is broken login/ui
  • #27761 Snyk workflow failure ci
  • #27779 Broken Migration "MigrateTo24_0_0" core
  • #27780 Fixing downstream documentation build docs
  • #27797 User profile fields cannot be set empty once they have a non-empty value (in Login Theme) user-profile
  • #27820 Account console confusing with WebAuthn account/ui
  • #27841 ES translation causes FreeMarker rendering issues translations
  • #27852 VerifyUserProfile invalidates user cache on every login core
  • #27878 Error when executing refresh grant, with scope param, without offline_access scope specified oidc
  • #27882 Incorrect version of bctls-fips in the docs docs
  • #27892 Truststore handling for the Operator is not documented operator
  • #27894 Multi datasource configuration does not work in Keycloak 24.0.1 dist/quarkus
  • #27900 Performance impact in changed hashing measured wrong authentication
  • #27925 Keycloak docs state that there are http metrics, but they are disabled docs
  • #27954 Hibernate Dialect detection does not work anymore for Oracle DBs storage
  • #27966 🍺 instead of dot: Attributes in account UI are not loaded user-profile
  • #27967 ORA-01450 when updating keycloak 23 -> 24 storage
  • #27981 User Profile: Inconsistent ordering of attributes between account and login themes user-profile
  • #28001 MySQL connector artifact should be ignored dist/quarkus
  • #28012 Keycloak CR Truststore should not have a name operator
  • #28113 WebAuthN registration broken after upgrading to 24.0.1 authentication/webauthn

24.0.1

2 months ago

Highlights

Operator deploys nightly build instead of 24.0.0

Due to an issue in the release process when deploying Keycloak using the Operator it installed the nightly container instead of 24.0.0.

As a quick fix to the issue, the 24.0.0 container was tagged with nightly, and the nightly releases was temporarily disabled.

If you installed or upgraded to 24.0.0 using the Operator before 5pm CET yesterday the database may have been updated with the wrong versions. To check if you are affected connect to your database and run the following SQL command:

SELECT * from migration_model WHERE version = '999.0.0';

If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for future releases. To resolve this run the following SQL command:

UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

24.0.0

2 months ago

23.0.7

2 months ago

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Enhancements

  • #26810 Shorter lifespan for offline session cache entries in memory storage

Bugs

  • #22431 Localization: Admin UI doesn't pick up message bundles from realms other than master admin/ui
  • #23786 Failure: FipsDistTest ci
  • #25294 Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off ldap
  • #25731 /admin/realms/{realm}/groups Endpoint is slow admin/api
  • #25883 ldap-group-mapper fails when empty member: attribute is present ldap
  • #25912 LDAP federation reports "Creating new LDAP Store..." on every login ldap
  • #25961 Native SQL Schema names broken on MySQL storage
  • #26374 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci
  • #26529 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci
  • #26826 Freemarker erroneously escapes/sanitizes URL in template.ftl (&) login/ui
  • #27120 Microsoft social login failure testsuite

23.0.6

3 months ago

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Bugs

  • #26427 Operator CSV uses wrong format for `createdAt` field operator
  • #26597 Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number core
  • #26665 Unable to modify access token lifespan at realm level. Keycloak stops working. core

23.0.5

3 months ago

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

23.0.4

4 months ago

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

23.0.3

4 months ago

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

23.0.2

4 months ago

Highlights

Non-blocking health check for load balancers

A new health check endpoint available at /lb-check was added. The execution is running in the event loop which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. This behavior is useful, for example, in multi-site deployment where we do not want to fail over to the other site under heavy load. The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.

This endpoint is not available by default. To enable it, run Keycloak with feature multi-site. Proceed to Enabling and disabling features guide for more details.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Enhancements

  • #25113 Add a test for the LoadBalancerCheck
  • #25287 Upgrade Infinispan to 14.0.21.Final

Bugs

  • #24652 SAML decryption fails if keycloak.saml.deprecated.encryption flag is set saml
  • #24986 `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive core
  • #25001 Client redirect_uri check must be compared using exact string matching oidc
  • #25010 Bug: KC_DB_USERNAME environment variable is causing a crash in latest version dist/quarkus
  • #25051 Unexpected Application Error when clicking "Cancel" on user creation page admin/ui
  • #25108 Documentation Inconsistency about Open Banking(Finance) Brasil FAPI security profile docs
  • #25124 If a client does not have a URL the applications page in the account console links to about:blank account/ui
  • #25173 Make sure username is lowercase when normalizing attributes user-profile
  • #25183 NullPointerException thrown for UPConfig.getGroups() user-profile
  • #25307 Keycloak instance `HasErrors` true after update: `More than 1 secondary resource related to primary` operator