Commit graph

1036 commits

Author SHA1 Message Date
Marek Posolda
f29249f3d7
Improve performance of scope processing in TokenManager. Limit for maximum length of OIDC parameters in Token endpoint (#478) (#47799)
closes #47716
Closes CVE-2026-4634


(cherry picked from commit b455ee4f28)

Signed-off-by: mposolda <mposolda@gmail.com>
2026-04-07 11:17:17 +02:00
Rahul Ramkumar
799699a808
Add KCRAW_ prefix for environment variables to preserve literal values (#47197)
Closes #46657

Signed-off-by: Rahul Ramkumar <rahulram226@gmail.com>
2026-04-07 10:12:18 +02:00
Alexander Schwartz
dee672728a
Fixing link as it has changed and is redirecting (#47793)
Closes #47792

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-04-07 09:52:45 +02:00
Alexander Schwartz
97fce120ac
Finalizing release notes and migration guide for 26.6 (#47791)
Closes #47790

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-04-07 09:44:13 +02:00
Steven Hawkins
51b6f9b291
fix: promotes keycloak and realm import to v2beta1 (#45840)
closes: #45795

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2026-04-04 16:46:28 +02:00
Václav Muzikář
3560286f0d
Update docs to better reflect FIPS support with Java 25. (#47699)
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
2026-04-02 15:04:15 +02:00
Stefan Guilhen
7e8eb64a52
Add troubleshooting section to workflows documentation
- also add workflows as supported in release notes

Closes #47692

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2026-04-02 00:05:04 +02:00
Václav Muzikář
d7238a77ba
Clarify Java 25 support scope in docs (#47539)
Closes #47537

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
2026-04-01 15:20:37 +02:00
Stefan Guilhen
031b6604a2 Ensure all workflow steps are described in the documentation.
- also change name of add/remove required action providers to better align with other step providers.

Closes #47655

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2026-04-01 09:10:59 -03:00
Takashi Norimatsu
a504df1a1c Update release-notes for CIMD
closes #47667

Signed-off-by: Takashi Norimatsu <takashi.norimatsu.ws@hitachi.com>
2026-04-01 12:42:53 +02:00
Giuseppe Graziano
46d1c4fa5a Sender constrained tokens for token exchange
Closes #46092

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
2026-04-01 10:23:51 +02:00
Martin Bartoš
c0458c0801 Provide documentation for customizable log service properties
Closes #47586

Co-authored-by: Daniele Mams <mammarella.daniele@gmail.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2026-03-31 11:16:29 +02:00
Stefan Guilhen
d24d2697aa Add SPI option to setup the start time of the workflows step runner task
Closes #47540

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
2026-03-27 16:30:15 -03:00
mposolda
5b82688883 Moving identity-broker-api to 'security and standards' section of release notes for 26.6.0
Some checks are pending
Weblate Sync / Trigger Weblate to pull the latest changes (push) Waiting to run
closes #45839

Signed-off-by: mposolda <mposolda@gmail.com>
2026-03-26 17:46:32 +01:00
Alexander Schwartz
ec07458cd5
Disable async startup when health probe is not enabled
Closes #47416

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-26 10:11:07 -03:00
rmartinc
b6fe6c2db8 Documentation for brokering API V2 and make it preview
Closes #46590
Closes #47259

Signed-off-by: rmartinc <rmartinc@redhat.com>
2026-03-26 11:13:58 +01:00
mposolda
02be20e9fa Inaccuracies in client federation documentation and tooltips
closes #47444

Signed-off-by: mposolda <mposolda@gmail.com>
2026-03-26 10:01:29 +01:00
Arman Taheri
9dbdde84d6
fix typo in documents (#47420)
Closes #47412
2026-03-25 08:01:25 +00:00
Stian Thorgersen
763bade3bf
Fix link to Facebook docs (#47422)
Signed-off-by: stianst <stianst@gmail.com>
2026-03-25 08:57:44 +01:00
mposolda
3f1567c7af Update authentication section in the Server Admin Guide Features section
Some checks are pending
Weblate Sync / Trigger Weblate to pull the latest changes (push) Waiting to run
closes #47393

Signed-off-by: mposolda <mposolda@gmail.com>
2026-03-24 19:26:50 +01:00
Gilvan Filho
ed66ac6b0c
add labels and annotations to service monitor (serviceMonitorSpec) (#47298)
* add labels and annotations to service monitor (serviceMonitorSpec)

closes #42626

Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>

* add labels and annotations to service monitor (serviceMonitorSpec)

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>

---------

Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2026-03-23 17:35:44 +00:00
Alexander Schwartz
86a44bd378
Review release notes about missing items (#47359)
* Review release notes about missing items

Closes #47358

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

* Apply suggestion from @stianst

Signed-off-by: Stian Thorgersen <stianst@gmail.com>

* Apply suggestion from @stianst

Signed-off-by: Stian Thorgersen <stianst@gmail.com>

---------

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Stian Thorgersen <stianst@gmail.com>
Co-authored-by: Stian Thorgersen <stianst@gmail.com>
2026-03-23 07:58:34 +01:00
Martin Bartoš
6db7608697
Missing release notes entry for OpenTelemetry span attributes location change (#47333)
Closes #47332

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-21 20:44:03 +01:00
Tero Saarni
50517cf933
Reload password blacklist file on change without restart
Fixes #47163

Signed-off-by: Tero Saarni <tero.saarni@est.tech>
2026-03-21 20:07:00 +01:00
Ricardo Martin
b93695eb90
Add versioning to identity brokering api feature (#47281)
Closes #47254

Signed-off-by: rmartinc <rmartinc@redhat.com>
2026-03-20 16:55:56 +01:00
Steven Hawkins
29d00b07f3
fix: use to values ahead of keycloak defaults (#46871)
* fix: use `to` values ahead of keycloak defaults

closes: #46728

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/documentation/upgrading/topics/changes/changes-26_6_0.adoc

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* Apply suggestion from @shawkins

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-03-20 14:42:49 +01:00
Pedro Ruivo
c93b6a7e6c
Asynchronous server initialization
Closes #47187

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Pedro Ruivo <pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
2026-03-19 21:23:46 +01:00
Ruchika Jha
37c9fd4de0
Added implementation for CLI option for database connection timeout and provide it into quarkus.datasource.jdbc.login-timeout
Closes #47140

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
2026-03-19 21:04:35 +01:00
Alexander Schwartz
b9cd14f931
Regroup the release notes by category
Closes #47239

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-18 14:29:17 +01:00
Peter Skopek
d11136f671 Separate password and OTP brute force protection to prevent OTP bypass attacks by default
Closes #46164

Signed-off-by: Peter Skopek <peter.skopek@ibm.com>

Update model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/remote/updater/loginfailures/LoginFailuresUpdater.java

Co-authored-by: Pedro Ruivo <pruivo@users.noreply.github.com>
Signed-off-by: Peter Skopek <peter.skopek@ibm.com>

Add recovery codes to the list of brute force checked authenticators.

Closes #46164
Signed-off-by: Peter Skopek <peter.skopek@ibm.com>
2026-03-17 18:57:37 +01:00
Ricardo Martin
3c7582f318
Broker token API for saml (#47087)
Closes #46589


Signed-off-by: rmartinc <rmartinc@redhat.com>
2026-03-17 18:29:48 +01:00
Alexander Schwartz
ac89a8c5e5
Move migration changes to already published release
Closes #47217

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-17 15:01:13 +01:00
Stian Thorgersen
607096fd4e
Promote federated client authentication, including OIDC and Kube to fully supported
Closes #42634, closes #42635, closes #42826, closes #44412

Signed-off-by: stianst <stianst@gmail.com>
2026-03-17 05:15:13 +01:00
Ricardo Martin
a712d01234
Change links from issues.redhat.com to redhat.atlassian.net (#47181)
Closes #47179

Signed-off-by: rmartinc <rmartinc@redhat.com>
2026-03-16 14:58:08 +01:00
Pedro Ruivo
94fb77b821
Update release notes with DB TLS options
Closes #47105

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2026-03-13 11:04:23 +01:00
Tero Saarni
e2e89523c5
Add release note for Envoy client certificate lookup (#47096)
* Add release note for Envoy client certificate lookup

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

* Fixed heading level, combined into one chapter

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

---------

Signed-off-by: Tero Saarni <tero.saarni@est.tech>
2026-03-12 15:26:23 -04:00
Ruchika Jha
efa2df641c
Added implementation for setting a default connection timeout for all databases types
Closes #46809

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-12 14:45:38 +01:00
Martin Kanis
db9a9d0de4 Fix organizations group docs to not include parent group in token claims
Closes #45516

Signed-off-by: Martin Kanis <mkanis@redhat.com>
2026-03-11 09:30:33 -03:00
Ryan Emerson
942fe0dfb2
Infinispan 16.0.8
Closes #47008

Signed-off-by: Ryan Emerson <remerson@ibm.com>
2026-03-10 14:43:44 +01:00
Martin Kanis
a6b31e879f
SCIM Track the last time a resource was modified
Closes #46223

Signed-off-by: Martin Kanis <mkanis@redhat.com>
2026-03-10 14:41:07 +01:00
vramik
367f9e2cc8 Organization Groups Documentation
Closes #45516

Signed-off-by: vramik <vramik@redhat.com>
2026-03-10 10:31:50 -03:00
Václav Muzikář
5c062a9e59
Downgrade server container image back to OpenJDK 21 (#46813)
* Downgrade server container image back to OpenJDK 21

Closes #46812

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

* Remove JDK downgrade note, rename attribute

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

---------

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
2026-03-10 14:26:11 +01:00
rmartinc
db7d9bfc8c Promote JWT Authorization Grant feature to supported
Closes #45463

Signed-off-by: rmartinc <rmartinc@redhat.com>
2026-03-10 09:13:44 +01:00
Oluwatobi Mustapha
24a819eabc
Fix FGAP deny evaluation for manage-group-membership
Add the missing Users FGAP scope alias from manage-group-membership to Groups manage-membership so deny permissions on group members apply during user membership updates.

Add a regression test covering a protected group member, an unrelated user, and the no-mutation postcondition after a forbidden request.

Closes keycloak#46693
2026-03-09 12:01:17 -03:00
Pedro Igor
14a3bc00ad
Stricter access control for managing permission tickets
Closes #46723

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
2026-03-08 12:45:34 +01:00
Copilot
8d318c552a
Add Traefik-specific X509 client certificate lookup provider (#46616)
* Add Traefik-specific X509 client certificate lookup provider

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* correcting the header handling and adding documentation

closes: #46395

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Conflicts:
#	docs/documentation/release_notes/topics/26_6_0.adoc

* Update docs/guides/server/reverseproxy.adoc

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* Apply suggestion from @shawkins

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* removing optional traefik behavior

and further refining the docs

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
2026-03-05 15:00:05 +01:00
Copilot
9682f6a9a0
Add log file rotation configuration options to allow disabling rotation (#46724)
* Add log file rotation configuration options to Keycloak

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* Update approved help texts and add release note for log file rotation
options

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* updating expected possible options

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/documentation/release_notes/topics/26_6_0.adoc

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/documentation/release_notes/topics/26_6_0.adoc

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
2026-03-05 10:37:41 +00:00
Copilot
d600298df7
operator: add support for configurable Kubernetes Service port and name in Keycloak CRD (#46683)
closes: #46633

* Add support for configurable Kubernetes Service port and name in Keycloak CRD

- Add serviceHttpPort and serviceHttpsPort fields to HttpSpec for configuring the service port independently of container port
- Add serviceName field to HttpSpec for customizing the service name
- Update KeycloakServiceDependentResource to use service ports with targetPort
- Update KeycloakClientBaseController to use service ports for admin URL
- Add unit tests and update test YAML

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* Remove HasMetadata getServiceName overload; add integration test for custom service name and port

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* refining the integration test

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Add documentation for configurable Service name and port in operator guide and release notes

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* Apply review suggestions to documentation wording

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
2026-03-04 10:49:51 -05:00
Sebastian Łaskawiec
35d725fe1b
Moved adding Kubernetes/OpenShift CAs to the server (#44506)
* Kubernetes Truststore moved to the server

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Update quarkus/config-api/src/main/java/org/keycloak/config/TruststoreOptions.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* addressing review comments and updating upgrade instructions

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* updating help command output

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/guides/server/keycloak-truststore.adoc

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Comments addressed

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* lint errors fix

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Update docs/documentation/upgrading/topics/changes/changes-26_6_0.adoc

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2026-03-04 16:39:10 +01:00
Ruchika Jha
8fc6af9b77
Changes for MSSQL Server, set sendStringParametersAsUnicode to false by default
Closes #46556

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Pedro Ruivo <pruivo@users.noreply.github.com>
2026-03-03 14:51:14 +00:00