Commit graph

322 commits

Author SHA1 Message Date
Rahul Ramkumar
799699a808
Add KCRAW_ prefix for environment variables to preserve literal values (#47197)
Closes #46657

Signed-off-by: Rahul Ramkumar <rahulram226@gmail.com>
2026-04-07 10:12:18 +02:00
Václav Muzikář
3560286f0d
Update docs to better reflect FIPS support with Java 25. (#47699)
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
2026-04-02 15:04:15 +02:00
Václav Muzikář
d7238a77ba
Clarify Java 25 support scope in docs (#47539)
Closes #47537

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
2026-04-01 15:20:37 +02:00
Marek Posolda
48b1d0fed9
Clarify in FIPS docs that it is still recommended to use Java 21 (#47623)
closes #47621

Signed-off-by: mposolda <mposolda@gmail.com>
2026-04-01 09:58:09 +02:00
Martin Bartoš
c0458c0801 Provide documentation for customizable log service properties
Closes #47586

Co-authored-by: Daniele Mams <mammarella.daniele@gmail.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2026-03-31 11:16:29 +02:00
Ruchika Jha
d721235190
Documention about the default db-schema being ambiguous
Closes #28970

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
2026-03-27 17:26:31 +01:00
Alexander Schwartz
ec07458cd5
Disable async startup when health probe is not enabled
Closes #47416

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-26 10:11:07 -03:00
Pedro Ruivo
636e7252af
Update docs to use new TLS options (#47288)
Closes #47104

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2026-03-24 10:06:32 +01:00
Steven Hawkins
29d00b07f3
fix: use to values ahead of keycloak defaults (#46871)
* fix: use `to` values ahead of keycloak defaults

closes: #46728

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/documentation/upgrading/topics/changes/changes-26_6_0.adoc

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* Apply suggestion from @shawkins

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-03-20 14:42:49 +01:00
Pedro Ruivo
c93b6a7e6c
Asynchronous server initialization
Closes #47187

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Signed-off-by: Pedro Ruivo <pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
2026-03-19 21:23:46 +01:00
Ruchika Jha
37c9fd4de0
Added implementation for CLI option for database connection timeout and provide it into quarkus.datasource.jdbc.login-timeout
Closes #47140

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
2026-03-19 21:04:35 +01:00
Pedro Ruivo
5fed5acef3
Em-Hyphens in SPI options on cache configuration page
Closes #46656

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2026-03-13 13:14:38 +01:00
Pedro Ruivo
c5c703c31f
Add Database CLI options for TLS encryption for databases
Some checks are pending
Weblate Sync / Trigger Weblate to pull the latest changes (push) Waiting to run
Closes #46603

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2026-03-12 18:28:11 +01:00
Ruchika Jha
efa2df641c
Added implementation for setting a default connection timeout for all databases types
Closes #46809

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-12 14:45:38 +01:00
Tero Saarni
b2a88bcb3d
Add client certificate lookup for Envoy proxy (#33159)
* Add client certificate lookup for Envoy proxy

This update introduces the ability to lookup X509 client certificates from
Envoy's x-forwarded-client-cert header, using either the Cert or Chain
parameters.

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

* added junit test cases for envoy x509 lookup

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

* Run spotless

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

* Added support for proxy-trusted-addresses

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

* Convert exception to SecurityException for invalid headers

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

* document update

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

---------

Signed-off-by: Tero Saarni <tero.saarni@est.tech>
2026-03-12 14:08:39 +01:00
Alexander Schwartz
168f824741
Fix formatting of examples
Closes #47075

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-12 08:50:18 -03:00
Václav Muzikář
7849ec77eb
Supported Configurations guide (#46817)
* Supported Configurations guide

Closes #45898

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

* Add K8s version ranges

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

* Update docs/guides/server/supported-configurations.adoc

Signed-off-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

* Tweak suggestion

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

* Remove downstream specific content, add mobile browsers note

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

---------

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
Signed-off-by: Václav Muzikář <vaclav@muzikari.cz>
2026-03-11 13:21:42 +01:00
Václav Muzikář
5c062a9e59
Downgrade server container image back to OpenJDK 21 (#46813)
* Downgrade server container image back to OpenJDK 21

Closes #46812

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

* Remove JDK downgrade note, rename attribute

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>

---------

Signed-off-by: Václav Muzikář <vmuzikar@ibm.com>
2026-03-10 14:26:11 +01:00
Copilot
8d318c552a
Add Traefik-specific X509 client certificate lookup provider (#46616)
* Add Traefik-specific X509 client certificate lookup provider

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* correcting the header handling and adding documentation

closes: #46395

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Conflicts:
#	docs/documentation/release_notes/topics/26_6_0.adoc

* Update docs/guides/server/reverseproxy.adoc

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* Apply suggestion from @shawkins

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* removing optional traefik behavior

and further refining the docs

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
2026-03-05 15:00:05 +01:00
Martin Bartoš
7cbf326895
Invalid links in logging guides (#46893)
Closes #46892

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2026-03-05 13:08:21 +01:00
Copilot
9682f6a9a0
Add log file rotation configuration options to allow disabling rotation (#46724)
* Add log file rotation configuration options to Keycloak

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* Update approved help texts and add release note for log file rotation
options

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* updating expected possible options

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/documentation/release_notes/topics/26_6_0.adoc

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/documentation/release_notes/topics/26_6_0.adoc

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
2026-03-05 10:37:41 +00:00
Sebastian Łaskawiec
35d725fe1b
Moved adding Kubernetes/OpenShift CAs to the server (#44506)
* Kubernetes Truststore moved to the server

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Update quarkus/config-api/src/main/java/org/keycloak/config/TruststoreOptions.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* addressing review comments and updating upgrade instructions

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* updating help command output

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/guides/server/keycloak-truststore.adoc

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Comments addressed

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* lint errors fix

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Update docs/documentation/upgrading/topics/changes/changes-26_6_0.adoc

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2026-03-04 16:39:10 +01:00
James Hewitt
1935cf9eff
Say export is not backup in the guide
Export isn't suitable for backup for a number of reasons, mention that in the guide, and tidy up some existing notes.

Closes #46796

Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-03 17:22:06 +01:00
Ruchika Jha
8fc6af9b77
Changes for MSSQL Server, set sendStringParametersAsUnicode to false by default
Closes #46556

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Pedro Ruivo <pruivo@users.noreply.github.com>
2026-03-03 14:51:14 +00:00
Pedro Ruivo
e5535d218b
Map transaction timeout to database lock timeout
Closes #46671

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-03 12:30:30 +01:00
Pedro Ruivo
33ff9f1b71
Check the Unicode setup of the database on startup
Closes #46557

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-03-01 14:15:44 +01:00
Pedro Ruivo
9430a3f928
Add CLI option for tx and migration timeout
Closes #19453

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
Co-authored-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>
2026-02-27 16:11:18 +00:00
Michal Vavřík
d2dc582b1c
Increase allowed additions to legacy testsuite to 100 lines (#46635) (#46563)
Signed-off-by: stianst <stianst@gmail.com>
Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
2026-02-27 15:21:08 +01:00
Ruchika Jha
f92c27e26d
Make rolling updates for patch releases fully supported and Updated docs, release notes and upgrading guide for zero-downtime patch releases
Closes #45381
Closes #45756

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-02-16 15:11:16 +00:00
Ruchika Jha
e82e107b85
Enable graceful HTTP shutdown and document default behavior
Closes #43589

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-02-13 14:28:49 +00:00
Steven Hawkins
3aa5ab0072
fix: updating the fix for docker ulimits (#46254)
it will now be applied by default

closes: #44232

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2026-02-12 10:28:53 +01:00
Steven Hawkins
783ea304af
fix: document passthrough backchannel limitation (#45915)
closes: #45606

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2026-02-11 10:44:19 -05:00
NAMAN JAIN
5967093142
Move HTTP access logs to data/log directory (#45991)
* Move HTTP access logs to data/log directory

The HTTP access log file is now written to the /data/log directory, alongside server logs.

Directory is created at runtime initialization if it does not exist.

Closes #45629

Signed-off-by: NAMAN JAIN <naman.049259@tmu.ac.in>

* Update help command expectations for HTTP access log directory change

Signed-off-by: NAMAN JAIN <naman.049259@tmu.ac.in>

* Apply suggestions from code review

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Fix build

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: NAMAN JAIN <naman.049259@tmu.ac.in>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
2026-02-11 11:50:22 +01:00
Steven Hawkins
38b5466093
fix: aligns our dev http-host default behavior with that of quarkus (#45691)
closes: #42876

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
2026-01-27 16:51:47 +01:00
Steven Hawkins
77704a91b6
fix: adding support for xforwarded prefix (#45699)
closes: #35298

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2026-01-26 18:14:54 +01:00
Vlasta Ramik
2f0689576b
Possible mismatch of charset/collation between columns on mysql/mariadb (#45632)
* Possible mismatch of charset/collation between columns on mysql/mariadb

Closes #45597

Signed-off-by: vramik <vramik@redhat.com>
2026-01-22 07:17:04 -03:00
Ruchika Jha
dbd8d47036
Upgrade command rolling updates for patch releases / step 3: Infinispan/JGroups
Closes #38884

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
2026-01-21 15:16:18 +01:00
Martin Bartoš
1138952ba7
Provide HTTP access logs written to file with rotation (#45437)
Closes #41353

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2026-01-20 15:16:33 +01:00
Martin Bartoš
137a35c110
Mask certain HTTP headers and cookies in the HTTP access log (#45400)
* Mask certain HTTP headers and cookies in the HTTP access log

Closes #43811

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>

* Improve tests, Improve docs

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Fix test

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2026-01-19 19:01:45 +01:00
Martin Bartoš
ab25c8e059 Fix link to OpenTelemetry guide in logging
Closes keycloak/keycloak-web#692

Co-authored-by: Ryan Emerson <remerson@ibm.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2026-01-15 11:05:21 +01:00
Stian Thorgersen
198730cd0d
Allow absolute path for cache-config-file (#45416)
Closes #19374

Signed-off-by: stianst <stianst@gmail.com>
2026-01-14 11:05:50 +00:00
Peter Zaoral
7da8a8a2e3
feat: add Windows service support (#44496)
Closes: #37704

Signed-off-by: Peter Zaoral <pepo48@gmail.com>
2025-12-19 16:55:42 +00:00
Stephan Seifermann
aefecade5c
Client cert lookup provider compliant to RFC 9440 (#36161)
* Client cert lookup provider compliant to RFC 9440 (#20761)

Signed-off-by: Stephan Seifermann <seiferma@users.noreply.github.com>

* Release notes

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>

---------

Signed-off-by: Stephan Seifermann <seiferma@users.noreply.github.com>
Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>
Co-authored-by: Stephan Seifermann <seiferma@users.noreply.github.com>
Co-authored-by: Václav Muzikář <vmuzikar@redhat.com>
2025-12-19 12:38:54 +01:00
Steven Hawkins
148d14816c
fix: allowing settable connection request timeout (#44592)
Some checks are pending
Weblate Sync / Trigger Weblate to pull the latest changes (push) Waiting to run
also defaulting to 5000

closes: #44500

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-12-16 16:35:01 +00:00
Martin Bartoš
29fdcedbc8
[OTel] Introduce preview support for OpenTelemetry Logs (#41265)
Closes #41264

Co-authored-by: Ryan Emerson <remerson@redhat.com

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2025-12-15 10:50:30 +01:00
Václav Muzikář
da6c4df5ec
Support EDB 18 (#44856)
* Support EDB 18

Closes #44494

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>

* Update test-framework/db-edb/container/README.md

Co-authored-by: Steven Hawkins <shawkins@redhat.com>
Signed-off-by: Václav Muzikář <vaclav@muzikari.cz>

---------

Signed-off-by: Václav Muzikář <vmuzikar@redhat.com>
Signed-off-by: Václav Muzikář <vaclav@muzikari.cz>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
2025-12-15 07:36:26 +01:00
alyneldc
56b08c02ed
Add documentation warning about 0.0.0.0 binding in dev mode (#43522)
Inform users that Keycloak binds to all network addresses (0.0.0.0) by default in development mode. Add warning in Getting Started guide and configuration documentation, and enhance HttpOptions description.

Closes #43522

Signed-off-by: Lopes De Carvalho Alyne <alynelopes298@gmail.com>
2025-12-07 14:45:34 +00:00
Sebastian Schuster
b5178a2bec
Added section on recommended isolation level to db guides
Closes #44611

Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2025-12-05 14:48:31 +01:00
Hisanobu Okuda
efa881d016
Add MariaDB to MySQL description and specify SQL to support UTF-8
Closes #44548

Signed-off-by: Hisanobu Okuda <hisanobu.okuda@gmail.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2025-11-28 11:03:11 +01:00
ruchikajha95
570ac40025
Promote MDC Logging Feature to Supported State
Some checks are pending
Weblate Sync / Trigger Weblate to pull the latest changes (push) Waiting to run
Closes #41205

Signed-off-by: Ruchika Jha <ruchika@li-0551ffcc-341d-11b2-a85c-a28deda416be.ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Ruchika Jha <ruchika@li-0551ffcc-341d-11b2-a85c-a28deda416be.ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2025-11-25 18:53:34 +00:00