# sso Published articles for sso. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak 26.7.4 released DevFeed: [Keycloak 26.7.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-09-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Quarkus](), [MariaDB](), [MySQL](), [saml]() Tags: [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.4 was released on September 16, 2026. The release includes security fixes for several CVEs, an upgrade to Quarkus 3.33.3.2, and fixes for performance, testing, documentation, administration, and UI issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state Enhancements #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus Bugs #49635 Performance issue with 26.6.2 dist/quarkus #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci #52015 New links errors for https://quarkus.io/guides docs #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan #52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 -- SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus #52241 Clicking on a sub group in the admin console throws an exception admin/ui #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite ## I Added Break-Glass Accounts Before My Home Lab Locked Me Out DevFeed: [I Added Break-Glass Accounts Before My Home Lab Locked Me Out]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-14T12:16:15Z Content type: article Language: en Sources: [Virtualization Howto]() Topics: [Homelab](), [Authentication](), [Single sign-on (SSO)](), [Docker](), [Database](), [networking](), [Server](), [Amazon Route 53]() Tags: [authentication](), [container](), [database](), [dns](), [docker](), [home-lab](), [home-server](), [infrastructure](), [networking](), [server](), [sso]() ### AI overview The article explains why a home lab that centralizes authentication through single sign-on can become inaccessible during an outage. It introduces "break glass" accounts as a recovery measure and emphasizes treating the authentication service as infrastructure with dependencies such as its application, database, certificates, networking, reverse proxy, and DNS. ### Source excerpt One of the coolest things that you can do is centralize your authentication in the home lab. So, instead of having all kinds of separate usernames and passwords that are... The post I Added Break-Glass Accounts Before My Home Lab Locked Me Out appeared first on Virtualization Howto. ## How to answer the identity questions on an enterprise security questionnaire DevFeed: [How to answer the identity questions on an enterprise security questionnaire]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Security](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [App]() Tags: [configuration](), [enterprise](), [how-to](), [identity](), [integration](), [oidc](), [okta](), [provisioning](), [saml](), [security](), [sign-in](), [sso]() ### AI overview A practical guide to answering identity-related questions in enterprise security questionnaires. It explains what reviewers are really assessing behind SAML single sign-on and SCIM provisioning questions, including implementation details such as per-organization configuration, certificate rotation, and reliable deprovisioning. ### Source excerpt Every line has a literal answer and a real question behind it. Here is what the buyer is actually checking, which answers you can buy, and the three you cannot fake. ## Pay only for what you use: introducing no spend minimums to Temporal Cloud DevFeed: [Pay only for what you use: introducing no spend minimums to Temporal Cloud]() Original publisher: [Read original article]() Author: Tlo Lorinc Published: 2026-09-14T00:00:00Z Content type: release Language: en Sources: [Temporal Blog]() Topics: [Cloud](), [cloud-infrastructure](), [App]() Tags: [announcements](), [billing](), [cloud](), [developer](), [pricing](), [sso](), [support]() ### AI overview Temporal introduces a Paygo offering for Temporal Cloud with no base monthly fee, usage-based pricing, Developer Support, and SAML SSO included. The article explains pricing, support terms, storage charges, and migration options for existing self-service customers. ### Source excerpt Start building on Temporal Cloud with no base monthly fee, usage-based pricing, and Developer Support that scales with your application. ## How to Implement OIDC Back-Channel Logout DevFeed: [How to Implement OIDC Back-Channel Logout]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [JSON Web Tokens](), [App](), [Server]() Tags: [how-to](), [implement](), [jwt](), [oidc](), [server](), [sso](), [token](), [tokens]() ### AI overview This tutorial explains OIDC back-channel logout, including provider discovery, endpoint registration, form-encoded logout requests, and logout-token validation. It also describes how session-specific and user-wide logout work and notes limitations acknowledged by the specification. ### Source excerpt It is the one standard that can end a session your app already issued, it has been final since 2022, and almost nobody implements it. Here is the whole mechanism, the validation your endpoint owes, and the two limitations the spec admits to itself. ## How to add SSO to your B2B SaaS app with WorkOS AuthKit DevFeed: [How to add SSO to your B2B SaaS app with WorkOS AuthKit]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-07T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Software as a service](), [Authentication](), [SDKs]() Tags: [asp-net](), [asp-net-core](), [authentication](), [b2b](), [claude](), [cli](), [codex](), [configuration](), [cursor](), [how-to](), [saas](), [sdk](), [sso]() ### AI overview A tutorial on adding SSO to a B2B SaaS application with WorkOS AuthKit. It explains that AuthKit handles SSO-specific SAML operations, while developers must design the organization model, configure who manages connections, account for existing users, and test failure cases. ### Source excerpt Enabling SSO is a dashboard toggle. The real work is the organization model, self-service configuration, and the traps that surface after your first enterprise customer. ## Auth0 vs Frontegg vs WorkOS: Who's actually enterprise ready in 2026? DevFeed: [Auth0 vs Frontegg vs WorkOS: Who's actually enterprise ready in 2026?]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-07T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Single sign-on (SSO)](), [Authentication](), [Authorization]() Tags: [auth0](), [comparison](), [enterprise](), [feature](), [pricing](), [sso]() ### AI overview The article compares Auth0, Frontegg, and WorkOS on enterprise readiness by checking vendors' pricing pages for self-service SSO and SCIM, enterprise features, and costs at scale. It highlights conflicting information on Auth0's pricing page about Self-Service SSO and describes a footnote requiring an upgrade to B2B to continue using certain features. ### Source excerpt We checked the roundups' claims against all three vendors' own pricing pages, using one test: can your customer's IT admin configure SSO and SCIM themselves, on the plan you already pay for? ## Three identity vendors shipped the same agent access pattern in eight days DevFeed: [Three identity vendors shipped the same agent access pattern in eight days]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-04T16:24:43Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Authorization](), [MCP](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [Model Context Protocol]() Tags: [anthropic-claude](), [api](), [auth0](), [authorization](), [cross-app-access](), [identity](), [mcp](), [oidc](), [okta](), [sso]() ### AI overview Okta, Auth0, and Descope shipped implementations of the Cross App Access agent-access pattern between August 24 and September 1. The pattern uses a Client ID Metadata Document to identify calling software and an ID-JAG token exchange to let an identity provider control application access. ### Source excerpt Okta, Auth0, and Descope all shipped Cross App Access between August 24 and September 1. The two-layer pattern underneath it outlasts whichever vendor wins. ## Auth0 launches Early Access for enterprise-managed authorization in client apps DevFeed: [Auth0 launches Early Access for enterprise-managed authorization in client apps]() Original publisher: [Read original article]() Author: Mira Sharma Published: 2026-09-01T00:00:00Z Content type: release Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authorization](), [AI Agent](), [Model Context Protocol](), [OAuth](), [Single sign-on (SSO)]() Tags: [ai](), [ai-agent](), [authentication](), [enterprise](), [identity](), [mcp](), [model-context-protocol](), [oauth](), [release](), [saas](), [security](), [sso]() ### AI overview Auth0 announces Early Access for Client App capabilities that implement enterprise-managed authorization through Cross App Access and the ID-JAG draft specification. The feature lets an application or AI agent request access to external APIs or MCP servers using an employee's existing corporate SSO trust, reducing custom token-exchange work and supporting centralized governance. ### Source excerpt Implement Enterprise-Managed Authorization in Auth0 using Cross App Access (XAA) and ID-JAG. Build enterprise-ready AI agents without friction. ## Your app is the other half of agent SSO DevFeed: [Your app is the other half of agent SSO]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T20:22:53Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Authorization](), [JSON Web Tokens](), [OAuth 2.0](), [computer-use]() Tags: [ai-agents](), [app](), [authorization](), [jwt](), [oauth-2-0](), [security](), [sso]() ### AI overview This commentary explains that Okta's Agent SSO and the Cross App Access standard broker connections between AI agents and enterprise applications, but the connected application remains responsible for validating the grant and issuing its own access token. It describes the resource-side roles and the underlying OAuth and JWT-based standards. ### Source excerpt Okta's Agent SSO went GA on the Cross App Access standard. The IdP brokers the connection, but your app still has to validate the grant and issue the token. ## Keycloak 26.7.3 released DevFeed: [Keycloak 26.7.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA]() Tags: [2026](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [oidc](), [openid-connect](), [recaptcha](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.3 was released on August 31, 2026. The release includes security fixes addressing LDAP certificate verification, signed-JWT assertion policies, authorization controls, information disclosure, token exchange restrictions, OIDC response-parameter injection, and related issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange #5137 ## How to migrate from a custom auth system to a third-party provider DevFeed: [How to migrate from a custom auth system to a third-party provider]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [migration](), [passwords](), [Single sign-on (SSO)](), [saml]() Tags: [auth](), [how-to](), [migration](), [password](), [rollback](), [saml](), [sso](), [third-party]() ### AI overview A guide to moving from a custom authentication system to a third-party provider. It explains how password-hash portability, SSO callback control, and an inventory of existing authentication components determine the migration strategy and cutover plan. ### Source excerpt What is actually portable, how to import password hashes without forcing a reset, and how to cut over with a rollback you can trust. ## How Auth0 Plans Support Apps From Vibe Coding to Enterprise SSO DevFeed: [How Auth0 Plans Support Apps From Vibe Coding to Enterprise SSO]() Original publisher: [Read original article]() Author: Ruhma Khawaja Published: 2026-08-25T00:00:00Z Content type: article Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authentication](), [Single sign-on (SSO)](), [app builder](), [Vibe coding](), [soc 2 compliance](), [Multitenancy]() Tags: [app-builder](), [auth0](), [authentication](), [compliance](), [soc-2-compliance](), [sso](), [vibe-coding]() ### AI overview The article describes how Auth0 positions its pricing and authentication plans for different stages of app development, from AI-assisted solo builders and startups to scaling companies and enterprises. It highlights free authentication, SSO, SCIM, organizations, and security compliance features. ### Source excerpt Learn how Auth0 pricing plans scale with your app -- from free auth for AI vibe coders to B2B Enterprise SSO for scaling startups and enterprise platforms. ## Add Cross App Access to Your OIDC Resource Application DevFeed: [Add Cross App Access to Your OIDC Resource Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-24T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [API](), [Authorization](), [JSON Web Tokens](), [Single sign-on (SSO)](), [OAuth 2.0]() Tags: [api](), [authorization](), [cross-app-access](), [jwt](), [oauth-2-0](), [oidc](), [okta](), [scopes](), [sso](), [token](), [xaa]() ### AI overview This guide explains how OIDC-federated applications can support Cross App Access (XAA) for API access on behalf of users. It covers validating and redeeming the ID-JAG, resolving users from claims, issuing access tokens, updating authorization server metadata, and testing the end-to-end flow. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your authorization server already trusts the customer's IdP for single sign-on (SSO), and XAA reuses that same trust for API access. This guide details what you need to support, how to validate the grant, and how to resolve the user at your resource authorization server. Table of Contents How XAA in OIDC works Analyzing the ID-JAG claims XAA implementation checklist for OIDC-federated applications Mapping user identity from iss and sub Validating the ID-JAG and resolving the user Issuing the access token Updating authorization server metadata Making cross-application requests from your OIDC app securely Configure your XAA OIDC Resource app in Okta Create the OIDC requesting app for testing Create the OIDC resource app in Okta Register and configure the AI Agent in Okta Verify your Okta XAA setup on xaa.dev Configure OIDC SSO Verify the refresh token exchange for an ID-JAG token Redeem the ID-JAG for an access token at the resource authorization server Call the resource API with the access token Prove the XAA connection end-to-end Takeaways for implementors who also have SAML apps Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the customer's Identity Provider (IdP) for your authorization server. Your resource server accepts the token, identifies the user, and issues your own access token, all while leaving the customer's existing OIDC integration untouched. The sequence diagram shown below describes the OIDC XAA flow. Notice that the OIDC SSO flow stays the ## KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague DevFeed: [KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague]() Original publisher: [Read original article]() Author: Alina Rudyk Published: 2026-08-23T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [identity and access management](), [openid](), [Security]() Tags: [iam](), [idm](), [kerberos](), [keycloak](), [ldap](), [openid](), [openid-connect](), [saml](), [security](), [sso](), [talk]() ### AI overview Keycloak has announced the speaker line-up and agenda for KEYCONF26, taking place in Prague on 8 October 2026. The programme covers Keycloak operations, extensions, identity standards, security, access tokens, and related use cases. ### Source excerpt The KEYCONF26 speaker line-up is taking shape, and this year's agenda is now live! 📍 KEYCONF26 is taking place in Prague on 8 October 2026. This October, the Keycloak community will come together once again for a full day of technical insights, real-world experiences and conversations around identity and access management. This year's programme brings together speakers from across the Keycloak ecosystem - from organisations running Keycloak in complex production environments to experts exploring new standards, architectures and use cases. Talk highlights The talks announced highlight the broad spectrum of the Keycloak ecosystem: how to run Keycloak securely and at scale, how to extend it, and how identity is evolving to support new technologies and use cases. Here are just a few highlights: What Role Can Keycloak Play for International Science? An Introduction to the OpenID Shared Signals Framework Keycloak becomes familiar with AI: the advancement of integrating Keycloak with AI Wicked Keycloak challenges and how to resolve them Token Hygiene - Why Your Keycloak Access Tokens Need a Diet And that is only a glimpse of what is waiting for you in Prague 👉 Explore the KEYCONF26 agenda announced: https://keyconf.dev/ A great place to network KeyConf is about more than the talks. It is also an opportunity to meet the people behind the technology, exchange experiences and connect with others working on similar identity challenges. Networking lunch Our extended lunch break gives you plenty of time to meet fellow attendees, swap ideas and continue conversations from the sessions in a relaxed setting. Meet the community KeyConf brings together Keycloak users, contributors, developers, architects, security specialists and IAM experts from different organisations and industries. Whether you want to discuss a challenge from your own Keycloak environment, exchange experiences or simply meet people from the community in person, there will be plenty of opportunities to connect thr ## Add Cross App Access to Your OIDC Requesting Application DevFeed: [Add Cross App Access to Your OIDC Requesting Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-21T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [OAuth](), [OAuth 2.0](), [JSON Web Tokens](), [API](), [Authorization](), [AI Agent]() Tags: [agent](), [api](), [authorization](), [callback](), [claude](), [cross-app-access](), [identity](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [sso](), [third-party-applications](), [token](), [xaa]() ### AI overview This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t ## Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM DevFeed: [Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [saml](), [Security]() Tags: [auth0](), [enterprise](), [oidc](), [provisioning](), [saml](), [sso]() ### AI overview This comparison examines Auth0 Enterprise Connect, which is in beta, alongside WorkOS for enterprise SSO and SCIM. It explains how Auth0 preserves an existing authorization server while adding enterprise identity capabilities, and highlights differences in SCIM direction, plan tier, pricing, and access requirements. ### Source excerpt Auth0's beta keeps the authorization server you already run and adds the enterprise surface around it. The differences from WorkOS show up in SCIM direction, plan tier, and which pricing table you are actually reading. ## How to add enterprise SSO to an Express.js API DevFeed: [How to add enterprise SSO to an Express.js API]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Tutorial](), [Express](), [Node.js](), [API](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [Authorization](), [Back end]() Tags: [api](), [authorization](), [how-to](), [js](), [jwt](), [middleware](), [node-js](), [oidc](), [security](), [sso]() ### AI overview A step-by-step tutorial for adding enterprise SSO to an Express.js API with WorkOS. It covers SAML and OIDC login redirects, callback handling, JWT verification on protected routes, and multi-tenant authorization using signed token claims. ### Source excerpt Add enterprise SSO (SAML and OIDC) to an Express.js API with WorkOS. Step-by-step Node.js code for the login redirect, the callback, and JWT verification on protected API routes. ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Enterprise Managed Users is now generally available DevFeed: [Enterprise Managed Users is now generally available]() Original publisher: [Read original article]() Author: Bel Curcio Published: 2026-08-11T20:38:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Single sign-on (SSO)](), [Authentication](), [Provisioning]() Tags: [authentication](), [docs](), [enterprise](), [identity](), [provisioning](), [sign-in](), [sso](), [updates](), [vercel]() ### AI overview Vercel Enterprise Managed Users is now generally available, giving organizations centralized control over accounts on verified domains through SAML SSO, Directory Sync, and IdP-managed profiles. ### Source excerpt Enterprise Managed Users (EMU) gives organizations full control over the Vercel accounts tied to their verified domains. It makes the organization's identity provider the single source of truth for authentication and account lifecycle, so accounts on company domains are governed centrally rather than owned by individuals. Now generally available IdP-enforced sign-in: Managed users sign in through SAML SSO only. All other login methods, including email OTP, GitHub, Google, and GitLab, no longer work for managed accounts. SCIM provisioning & lifecycle: Directory Sync creates, updates, and deprovisions managed users automatically, keeping accounts in sync with your IdP. Owned by your organization: Profile settings are managed through your IdP rather than by the individual. Self-serve enablement: Turn EMU on for a verified domain in Team Settings under Security & Privacy, and extend it across multiple eligible teams in a single step. Requires an Enterprise plan, enforced SAML SSO, active Directory Sync, and at least one verified domain. In Beta, available on request Hobby team transition: Members with an existing personal account on a newly managed domain are guided to add a personal email (keeping their hobby projects) or delete the account, then continue to their work through SSO. Automatic conversion: Personal accounts with no content or activity are archived automatically, and their owners land in a new managed account at their next SSO sign-in. To request access, contact your account team. Learn more in the Enterprise Managed Users and Hobby team transition docs. Read more ## Keycloak 26.7.1 released DevFeed: [Keycloak 26.7.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [saml](), [LDAP](), [WebAuthn]() Tags: [2026](), [authorization](), [cve](), [extension](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.1 is released with multiple security fixes addressing authorization bypasses, privilege escalation, protocol validation issues, and other vulnerabilities, along with bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers Bugs #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn #50750 Clustering test broken in 26.7 release branch ci #50836 Kustomize cluster-wide faulty Role&RoleBinding operator #50850 New Password is commited when multiple Password Reset is detected authentication #50882 500 when client requests `organization` scope with it already set to `Default` authentication #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core ## Keycloak Client Libraries 26.0.12 released DevFeed: [Keycloak Client Libraries 26.0.12 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Caching](), [Security](), [client](), [test]() Tags: [cache](), [idm](), [kerberos](), [keycloak](), [keycloak-client-libraries-release](), [ldap](), [openid-connect](), [resolved](), [saml](), [security](), [sso](), [test]() ### AI overview Keycloak Client Libraries 26.0.12 was released with security fix #234, which normalizes URIs so mutated URIs share the cache key of their canonical form, and bug fix #231 related to changed authentication resource behavior causing test failures. ### Source excerpt Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #234 Normalize URIs in PathConfigMatcher to ensure mutated URIs share the same cache key as their canonical form client Bugs #231 AuthenticationManagementResource changed behavior causes test failures client ## The future of the Keycloak Discourse forum DevFeed: [The future of the Keycloak Discourse forum]() Original publisher: [Read original article]() Author: GR Patil, Niko Köbler Published: 2026-07-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [ai-coding](), [dev-tools](), [maintenance](), [Security]() Tags: [ai](), [ai-coding](), [developer-tools](), [idm](), [kerberos](), [keycloak](), [ldap](), [maintenance](), [openid-connect](), [saml](), [security](), [sso]() ### AI overview The Keycloak project announces that it will wind down its Discourse forum. The article explains the forum's historical role, increased use of AI coding assistants and search-like developer tools, reduced forum activity, and the maintenance effort required to keep it open. ### Source excerpt The Keycloak project has always relied on open, searchable, community-owned discussion. Over the years, the Keycloak Discourse forum has been an important part of that: a place where users could ask configuration questions, share migration experiences, debug integrations, and find answers from people who had solved similar problems before. After a lot of consideration, we have decided to wind down the Keycloak Discourse forum. This is not a decision we are taking lightly. The forum contains many years of useful community knowledge, and we recognize the role it has played for Keycloak users. We also recognize that previous changes to the forum caused disruption. For that reason, we want to explain why we are making this change, how it will happen, when it will happen, and where the community should go next. Why we are making this change In June 2023, the Keycloak maintainers decided to sunset Discourse as one of the project's communication channels. That decision was met with strong feedback from the community. Many users explained that Discourse filled an important role that was not fully covered by mailing lists, GitHub Discussions, or chat. After listening to that feedback, we reactivated Discourse in October 2023. In the years since, the way developers seek help has changed. More and more Keycloak users now turn first to AI coding assistants and search-like developer tools when they need help configuring Keycloak, troubleshooting integrations, or understanding errors. Those tools have almost certainly learned from many of the public sources the community has created over the years, including the Discourse forum, GitHub Discussions, mailing lists, documentation, blog posts, and issue trackers. That shift has changed the role of a community forum. The old model depended on a steady flow of new questions, answers, corrections, and follow-up discussion. Without that activity, the forum risks becoming a stale support archive rather than a healthy community space. Keep ## Enable Your SAML Requesting App for Cross App Access DevFeed: [Enable Your SAML Requesting App for Cross App Access]() Original publisher: [Read original article]() Author: Alisa Duncan Published: 2026-07-17T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OAuth 2.0](), [Authorization](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [API](), [AI Agent]() Tags: [api](), [authorization](), [claude](), [cross-app-access](), [digital-signature](), [identity](), [idp](), [implementation](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [payload](), [saml](), [signing](), [sso](), [xaa]() ### AI overview This guide explains how SAML-federated applications can use Cross App Access (XAA) to connect to third-party applications without migrating to OpenID Connect. It covers exchanging a SAML assertion for an OAuth refresh token, an ID-JAG, and an access token, along with token validation and Okta configuration. ### Source excerpt If you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to connect with third-party applications without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was originally designed with OIDC in mind. To use it in SAML applications, you must accommodate specific security and uniqueness requirements. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in SAML works XAA implementation checklist for SAML-federated applications Request the refresh token Request the ID-JAG token Request the access token Handle token expiration Making cross-application requests from your SAML app securely Configure your XAA SAML Requesting App in Okta Register and configure the AI Agent in Okta Test the SAML 2.0 app Validate the XAA connection end-to-end Learn more about Cross App Access, SAML, and OAuth 2.0 How XAA in SAML works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram shown below describes the SAML XAA flow and how your application fits in. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using a refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for SAML-federated applications Follow the guide in this section to support XAA in your SAML application when your app connects to a third-party resource application. The XAA flow places the burden of token validation onto the IdP and the resource ap [Next page]()