# LDAP LDAP is an Internet standards-track protocol whose elements provide access to distributed directory services. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak 26.7.3 released DevFeed: [Keycloak 26.7.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA]() Tags: [2026](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [oidc](), [openid-connect](), [recaptcha](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.3 was released on August 31, 2026. The release includes security fixes addressing LDAP certificate verification, signed-JWT assertion policies, authorization controls, information disclosure, token exchange restrictions, OIDC response-parameter injection, and related issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange #5137 ## Keycloak 26.7.1 released DevFeed: [Keycloak 26.7.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [saml](), [LDAP](), [WebAuthn]() Tags: [2026](), [authorization](), [cve](), [extension](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.1 is released with multiple security fixes addressing authorization bypasses, privilege escalation, protocol validation issues, and other vulnerabilities, along with bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers Bugs #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn #50750 Clustering test broken in 26.7 release branch ci #50836 Kustomize cluster-wide faulty Role&RoleBinding operator #50850 New Password is commited when multiple Password Reset is detected authentication #50882 500 when client requests `organization` scope with it already set to `Default` authentication #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core ## Keycloak 26.4.6 released DevFeed: [Keycloak 26.4.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-11-25T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [Security](), [upgrade](), [version]() Tags: [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [release](), [saml](), [security](), [sso](), [upgrade](), [version]() ### AI overview Keycloak 26.4.6 adds default filtering of LDAP referrals, improving security and aligning with LDAP configuration best practices. The release also includes a security fix for deserialization of untrusted data in LDAP user federation and other resolved issues. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release adds filtering of LDAP referrals by default. This change enhances security and aligns with best practices for LDAP configurations. If you can not upgrade to this release yet, we recommend disabling LDAP referrals in all LDAP providers in all of your realms. For detailed upgrade instructions, review the upgrading guide. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #44478 CVE-2025-13467 Deserialization of untrusted data in ldap user federation Bugs #43323 Sessions not removed when user is deleted infinispan #43738 UPDATE_EMAIL action invalidates old email login/ui #43754 Flaky test: org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest ci #43812 Admin console sends non-JSON payload with content-type: application/json admin/ui #44125 Double-encoding of query parameter values (e.g. acr_values) for version 26.4 identity-brokering #44187 [Keycloak Docs CI] Broken links docs #44189 [jdbc-ping] SQLIntegrityConstraintViolationException: Duplicate entry infinispan #44229 Unexpected FORMAT_FAILURE error when using cache-config-file with feature-disabled=persistent-user-sessions infinispan #44269 Admin Client creates malformed paths for requests admin/client-js #44287 Caching of static theme resources in dev mode is disabled core ## Keycloak 26.4.4 released DevFeed: [Keycloak 26.4.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-11-07T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [version](), [OpenID connect (OIDC)](), [LDAP](), [Quarkus]() Tags: [changes](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [version]() ### AI overview Keycloak 26.4.4 is released with enhancements and fixes covering client-scope discovery, verification-email rate limiting, workflow authorization, fine-grained permissions, OIDC, LDAP, WebAuthn, memory usage, and other administration and infrastructure issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #10388 Allow to hide client scopes from scopes_supported in discovery endpoint #43076 Add rate limiter for sending verification emails in context of update email #43509 Role authorization for workflows. admin/api Bugs #41270 Cannot save new attribute group admin/ui #41271 Changing user profile attribute results in an error everytime admin/ui #43082 ExternalLinksTest is broken due to missing path parameters docs #43091 Duplicate Email Fields on Temporarily Locked Out Sign In With Organization Identity-First Login login/ui #43160 Regression in DEBUG_PORT handling since 26.4.0 - host binding (*:port / 0.0.0.0:port) no longer works dist/quarkus #43460 FGAP/UI: `reset-password` succeeds but UI shows 403 without Users:manage admin/fine-grained-permissions #43505 DPoP proof replay check doesn't consider clock skew oidc #43516 Deleting Client is slow and fails when a lot of client sessions exist core #43578 "admin" client role now requires server admin user admin/api #43579 403 Forbidden when assigning realm-management client roles with realm-admin despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions #43596 FGAP: user can no longer open account management page, broken by `reset-password` admin/fine-grained-permissions #43621 Version 26.4.1 breaks existing ldap users with capital letters in username ldap #43682 When syncing roles, the database layer can see deadlocks #43698 Role Mapper is updating the user every time on login identity-brokering #43723 Only add the none verifier when attestation conveyance preference is none (or default) authentication/webauthn #43734 Refresh token allowed for offline session even the related scope is removed #43736 FGAP V2: reset-password scope error when viewing users with Group permissions only core #43744 Increased memory usage due to leaking Keyc ## Keycloak 26.3.4 released DevFeed: [Keycloak 26.3.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-09-12T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [Database](), [LDAP](), [OpenID connect (OIDC)]() Tags: [database](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.3.4 is a release that includes an enhancement, an upgrade to Quarkus 3.20.2.2, and fixes covering session timeouts, database errors, login flows, LDAP group synchronization, configuration, documentation, user-profile validation, and the admin UI. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #40630 Double check when working with multithreading. SAST #42245 Upgrade to Quarkus 3.20.2.2 Bugs #35825 Per client session idle time capped by realm level client idle timeout core #40374 Random but frequent duplicate key value violates unique constraint \"constraint_offl_us_ses_pk2\" errors authentication #40463 Login to Account Console produces two consecutive LOGIN events account/ui #40857 Unbounded login_hint Parameter Can Corrupt KC_RESTART Cookie and Break Login Flow oidc #41427 Parallel token exchange fails if client session is expired token-exchange #41801 Lack of coordination in database creation in 26.3.0 causes deployment failures (Reopen) core #41942 Uncaught server error: org.keycloak.models.ModelException: Database operation failed : Sync LDAP Groups to Keycloak (Custom Provider) core #42012 Client session timestamp not updated in the database if running multiple nodes infinispan #42046 KeycloakRealmImport placeholder replacement provides access to sensitive environment variables. operator #42158 Bug in configuration keycoak via keycloak.conf dist/quarkus #42164 [Keycloak CI - Docs] Broken links core #42178 Integer validation error not shown for user profile fields user-profile #42182 Validation errors for required actions don't show translated messages admin/ui #42270 Missing double-dash in the events documentation core #42339 Allowed Client Scopes add openid scope in scope list oidc #42369 Missing client session offline settings on realm level in the admin UI admin/ui ## Keycloak 26.3.3 released DevFeed: [Keycloak 26.3.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-08-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [Caching](), [LDAP](), [OpenID connect (OIDC)]() Tags: [2025](), [caching](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [upgrade]() ### AI overview Keycloak 26.3.3 is released with enhancements, dependency upgrades, and fixes across caching, Quarkus, LDAP, OIDC, documentation, clustering, administration, and security. The release includes a fix for CVE-2025-7962 in Jakarta Mail. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #41558 Ensure cache configuration has correct number of owners #41934 Infinispan 15.0.19.Final #41963 Upgrade to Quarkus 3.20.2.1 dist/quarkus Bugs #39562 Breaking template change: Unknown `locale` input field added to user-profile registration page user-profile #40984 Backchannel logout token with an unexpected signature algorithm key oidc #41023 Can't send e-mails to international e-mail addresses: bad UTF-8 syntax core #41098 Locked out after upgrade to 26.3.1 due to missing sub in lightweight access token core #41268 `--optimized` flag and providers jar are incompatible when used with tools changing `last-modify-date` dist/quarkus #41290 Concurrent starts with JDBC_PING lead to a split cluster infinispan #41390 JDBC_PING2 doesn't merge split clusters after a while infinispan #41421 Broken link securing-cache-communication in caching docs docs #41423 Duplicate IDs in generated all configuration docs docs #41469 Uncaught exception cases unclosed spans in tracing dist/quarkus #41488 Synchronize Maven surefire plugin with Quarkus dist/quarkus #41491 ExternalLinks are broken in documentation docs #41520 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and KERBEROS_PRINCIPAL was null on creation ldap #41532 LDAP Sync all users takes unexpectedly long in 26.3 (> 30 min) ldap #41537 Getting error 405 "Method Not Allowed" when calling the "certs" endpoint with HEAD method oidc #41643 Test SMTP connection fails when no port is specified admin/api #41663 Typo in the caching doc docs #41677 Provider default regression dist/quarkus #41808 CVE-2025-7962 In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages core #41842 memberOf attribute empty or values with a DN that does not match the role base DN fet ## Keycloak 26.0.6 released DevFeed: [Keycloak 26.0.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-11-22T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [OpenID connect (OIDC)](), [proxy]() Tags: [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [migration-guide](), [oidc](), [openid-connect](), [release](), [reverse-proxy](), [saml](), [server](), [sso]() ### AI overview Keycloak 26.0.6 was released on November 22, 2024. The release adds additional context details to some admin events, updates the database schema with a DETAILS_JSON column, revises documentation for X.509 client-certificate lookup through a reverse proxy, and includes enhancements and bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Highlights Admin events might include now additional details about the context when the event is fired In this release, admin events might hold additional details about the context when the event is fired. When upgrading you should expect the database schema being updated to add a new column DETAILS_JSON to the ADMIN_EVENT_ENTITY table. Updates to documentation of X.509 client certificate lookup via proxy Potential vulnerable configurations have been identified in the X.509 client certificate lookup when using a reverse proxy. Additional configuration steps might be required depending on your current configuration. Make sure to review the updated reverse proxy guide if you have configured the client certificate lookup via a proxy header. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #34315 Update the Keycloak CPU and Memory sizing guide to reflect the new ec2 workder nodes #34386 Some dynamic imported functions are also statically imported making bundling them in-efficient #34570 Make documentation more clear that keycloak javascript adapter and node.js adapter are OIDC docs #34855 Add conditional text to Installation Locations #34873 Update Leveraging JaKarta EE in Server Development guide #34887 Apply QE edits to High Availability guide Bugs #609 Workflow failure - Jakarta - SAMLServiceProviderTest.testAccessAccountManagement quickstarts #11008 Incorrect get the members of a group imported from LDAP ldap #17593 Incorrect ldap-group-mapper chosen to sync changes to ActiveDirectory when several mappers with varying group paths used ldap #19652 Members are inhereted from LDAP group with the same name ldap #23732 JavascriptAdapterTest errors when running with strict cookies on Firefox ci #27856 Social login - Stack Overflow test fails ci #31456 Enabling/Disabling user does not work with Microsoft AD LDAP via Admin API/UI ldap #32786 Organization ## Keycloak 26.0.5 released DevFeed: [Keycloak 26.0.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-11-01T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [active directory](), [Microsoft]() Tags: [active-directory](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [openid-connect](), [release](), [resolved](), [saml](), [sso]() ### AI overview Keycloak 26.0.5 is released with a change that creates LDAP users as enabled by default when using Microsoft Active Directory through the administrative interfaces. The release also includes resolved issues affecting the admin UI, login layout, documentation, identity provider migration, and AD entry updates. ### Source excerpt To download the release go to Keycloak downloads. Highlights LDAP users are created as enabled by default when using Microsoft Active Directory If you are using Microsoft AD and creating users through the administrative interfaces, the user will created as enabled by default. In previous versions, it was only possible to update the user status after setting a (non-temporary) password to the user. This behavior was not consistent with other built-in user storages as well as not consistent with others LDAP vendors supported by the LDAP provider. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #31415 Selection list does not close after outside click admin/ui #33607 Fix v2 login layout login/ui #33618 No message for `policyGroupsHelp` admin/ui #33640 Customizable footer (Keycloak 26) not displaying in keycloak.v2 login theme login/ui #34301 Remove inaccurate statement about master realm imports docs #34450 [26.0.2] Migration from 25.0.1 Identity Provider Errors identity-brokering #34467 Do not rely on the `pwdLastSet` attribute when updating AD entries ldap ## Keycloak 26.0.4 released DevFeed: [Keycloak 26.0.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-10-30T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [Kubernetes](), [Promise]() Tags: [bugs](), [changes](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [kubernetes](), [ldap](), [openid-connect](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.0.4 is released with enhancements and fixes covering the admin client, documentation, authorization JavaScript adapter behavior, authentication retry handling, distributed client scope updates, email security, password policy validation, LDAP operations, and user session processing. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #34284 Keycloak-admin-client should work with the future versions of Keycloak server admin/client-java #34382 Make the organization chapter of Server Admin guide available on downstream Bugs #14562 Broken Promise implementation for AuthZ JS adapter/javascript #25917 Allow increasing wait time on each failure after the max number of failures is reached authentication #33627 ClassNotFoundException OracleXADataSource/OracleDataSource using IDELauncher with Keycloak 26.0.0 dist/quarkus #33731 Client Scope updates are not replicated on a distributed keycloak setup in kubernetes admin/api #33798 CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus #33987 keycloak.v2 registration: Password policy validation error "errorList is null" login/ui #34042 LDAP Pagination not working for role membership in GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE strategy ldap #34050 Listing federated LDAP users is very slow with import enabled ldap #34093 java.util.ConcurrentModificationException when process user sessions update infinispan #34412 LDAP: searching users with import disabled is slower since fix for 34050 ldap ## Keycloak 25.0.6 released DevFeed: [Keycloak 25.0.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-09-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [saml](), [Quarkus](), [WebAuthn]() Tags: [bugs](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [saml](), [sso]() ### AI overview Keycloak 25.0.6 is released with resolved issues affecting network responses, user properties, WebAuthn login flows, hostname paths, client annotations, realm imports, LDAP searches, and SAML security. The release also addresses two CVEs. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #30604 Network response was not OK. saml #31165 Re-enabling a temporarily locked user (brute-force) deletes all user properties and attributes admin/ui #32100 Remember Me with External Infinispan is not works properly infinispan #32578 WebAuthn Flows Broken in login.v2 login/ui #32643 Dots are not allowed in the path in Hostname v2 dist/quarkus #32731 KeyCloak Admin Client uses non-standard `@NoCache` annotation which is an issue for Quarkus admin/client-java #32799 Realm import fails when client configures default_acr values import-export #32870 Increased DB activity due to changes in LDAPStorageManager.searchForUserByUserAttributeStream ldap #33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect #33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak ## Keycloak 25.0.2 released DevFeed: [Keycloak 25.0.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-07-18T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [migration](), [LDAP](), [REST API](), [Quarkus]() Tags: [health-checks](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [migration-guide](), [openid-connect](), [release](), [rest-api](), [saml](), [secret-rotation](), [sso](), [translation]() ### AI overview Keycloak 25.0.2 was released on July 18, 2024. The release includes enhancements to management-interface configuration, Admin REST API documentation, and documentation language, along with fixes across the user interface, LDAP synchronization, authorization, migration, operators, and other components. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #30094 Do not inherit 'https-client-auth' property for the management interface #30537 Document how Admin REST API endpoints work with Hostname config docs #30856 Remove inclusive language foreword docs Bugs #19070 authBaseUrl error on different hostname-admin-url, hostname-url admin/ui #26042 Issue when start-dev in 23.0.1 dist/quarkus #28489 Missing help text on tokens tab admin/ui #29407 Need refresh attributes group translations on Users > Details tab admin/ui #29566 User Profile attributes/groups in Admin UI are not translated using Localization for non-master realm when signed in the master realm account/ui #29761 bug: disabling all default features no longer works core #29784 Exception while trying to run a LDAP sync with a group importer and a batch size less then the actual number of groups ldap #30329 Client secret rotation UI shows wrong rotated secret admin/ui #30355 New operator failing on health checks operator #30383 Account Console (v3) no longer highlights the current page in the nav bar account/ui #30436 Client Roles are not shown when clientId property is set admin/ui #30440 UI theme bug in KC 25.0.0 admin/ui #30444 Failed to evaluate permissions when fetchRoles is enabled on role policies authorization-services #30449 Migration stuck if versions incompatible operator #30521 "Client Offline Session Max" no longer available admin/ui #30541 Account UI resources try to load from admin path instead of frontend path account/ui #30552 After migrating from 24 to 25, the signature algorithms names do not display in drop down menu admin/ui #30591 Invalid character in spanish translation file for Identity Provider Link Template translations #30652 Default server port is used instead of the management interface port in the guide about running Keycloak in a container #30662 User policy -> se ## Keycloak 25.0.1 released DevFeed: [Keycloak 25.0.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-06-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authentication](), [LDAP](), [MariaDB](), [MySQL]() Tags: [bug](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [openid-connect](), [release](), [saml](), [sso](), [upgrade]() ### AI overview Keycloak 25.0.1 is a release update containing an enhancement and a list of resolved bugs affecting areas including the admin UI, configuration, authentication, databases, LDAP testing, and session migration. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #19750 Use a proper FreeMarker template for the new consoles account/ui #30346 Enhance masking around config-keystore dist/quarkus Bugs #25234 front channel logout to clients are not called at Identity Proxy when using front channel logout to Identity Provider( oidc #28643 Encountering `NullPointerException` - `KeycloakIdentity.getUserFromToken()` when running `admin-ui` locally admin/ui #30115 Admin v2 theme - theme.properties Custom theme scripts not loading admin/ui #30201 Keycloak CI - failure in Store IT (aurora-postgres) ci #30240 Custom attributes are removed during UPDATE PROFILE event core #30300 Upgrade to Keycloak 25 - Table 'USER_CONSENT' is specified twice on MySQL/MariaDB database core #30302 Methods of SimpleHttp are after change now too much protected core #30306 Upgrade to Keycloak 25 - Events bug in UI admin/ui #30332 Operator fails to patch ingress after update to 25.0.0 operator #30334 RESTART_AUTHENTICATION_ERROR when login in in private browser window after 25.0.0 update core #30351 Migration of sessions in KC25 should run only on migration, not on imports #30368 Documentation : label error for persistent-user-sessions feature flag docs #30417 Keycloak 25 db guide shows unevaluated "ifeval docs #30432 keycloak hostname:v2 /admin used on "hostname" instead of "hostname-admin" admin/ui #30434 Improvements for ldap test authentication ldap #30492 partial_import_test fails randomly admin/ui ## Keycloak 24.0.3 released DevFeed: [Keycloak 24.0.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-04-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [JavaScript](), [Authentication]() Tags: [api](), [authentication](), [idm](), [java](), [javascript](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [operator](), [release](), [resolved](), [saml](), [sso]() ### AI overview Keycloak 24.0.3 is released with enhancements and resolved issues affecting Microsoft Active Directory account propagation, LDAP-backed users, authentication, identity brokering, user updates, the JavaScript adapter, and the Keycloak Operator. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #26695 Keycloak and MSAD: enabling account in MSAD does not propagate to Keycloak ldap Bugs #24201 Cannot disable LDAP-backed user if importEnabled=false ldap #28100 Failed authentication: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.UserModel.getFederationLink()" because "this.delegate" is null identity-brokering #28248 Update user makes User ID changes when federationLink and LDAP_ID is not set properly admin/api #28335 The false option of the pkceMethod init parameter for the JavaScript adapter is ignored adapter/javascript #28638 Missing permission to read configmaps in `keycloak-operator-role` operator ## Keycloak 23.0.7 released DevFeed: [Keycloak 23.0.7 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-02-22T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [kerberos](), [Localization (l10n)](), [MySQL](), [Quarkus]() Tags: [bugs](), [changes](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [mysql](), [openid-connect](), [quarkus](), [release](), [reports](), [saml](), [sso]() ### AI overview Keycloak 23.0.7 is released with an enhancement to shorten offline session cache entry lifespans in memory storage and fixes affecting localization, Kerberos and LDAP integration, MySQL native SQL schema names, Freemarker URL handling, Microsoft social login tests, and CI workflows. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #26810 Shorter lifespan for offline session cache entries in memory storage Bugs #22431 Localization: Admin UI doesn't pick up message bundles from realms other than master admin/ui #23786 Failure: FipsDistTest ci #25294 Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off ldap #25883 ldap-group-mapper fails when empty member: attribute is present ldap #25912 LDAP federation reports "Creating new LDAP Store..." on every login ldap #25961 Native SQL Schema names broken on MySQL storage #26374 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci #26529 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci #26826 Freemarker erroneously escapes/sanitizes URL in template.ftl (&) login/ui #27120 Microsoft social login failure testsuite ## Keycloak 23.0.1 released DevFeed: [Keycloak 23.0.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2023-11-29T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [OpenID connect (OIDC)](), [saml](), [certificates](), [public key]() Tags: [bugs](), [http](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [migration-guide](), [oidc](), [openid-connect](), [public-key](), [release](), [saml](), [sso](), [update](), [x509]() ### AI overview Keycloak 23.0.1 was released on November 29, 2023. The release notes provide download and upgrade guidance and list resolved issues involving LDAP user storage, Firefox storage access, the admin console, X509 certificate validation, SAML, the Operator, group search, and token refresh. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #23841 Users page with LDAP User Storage Provider Cannot read properties of undefined admin/ui #23872 Attempt to request storage access in Firefox oidc #24261 "Unlink users"-Option greyed out in ldap federation admin/ui #24958 Error handling in admin console when update of user fails due the 400 HTTP error code admin/ui #24961 Keycloak not able to handle multiple validating X509 certificates when public key are the same saml #24984 Operator is missing CRDs metadata in CSV operator #25008 Group search when creating user admin/ui #25022 NPE in checkAndBindMtlsHoKToken on Token Refresh when using SuppressRefreshTokenRotationExecutor and Certificate Bound Token oidc ## Keycloak 22.0.2 released DevFeed: [Keycloak 22.0.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2023-09-11T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [kerberos](), [LDAP]() Tags: [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [release](), [saml](), [sso]() ### AI overview Keycloak 22.0.2 was released with improvements to LDAP and Kerberos integration, including support for multiple LDAP providers and Kerberos realm scenarios. The release also lists enhancements, upgrades, documentation changes, and bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Release notes Improvements in LDAP and Kerberos integration Keycloak now supports multiple LDAP providers in a realm, which support Kerberos integration with the same Kerberos realm. When an LDAP provider is not able to find the user which was authenticated through Kerberos/SPNEGO, Keycloak ties to fallback to the next LDAP provider. Keycloak has also better support for the case when single LDAP provider supports multiple Kerberos realms, which are in trust with each other. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #9422 Support kerberos realm filter on LDAP provider keycloak ldap #10232 Kill sessions after a password reset or MFA modification keycloak authentication #14665 map a kerberos provider to one or more ldap provider stores keycloak ldap #20931 Improvements on Documentation/Guides for "Hostname/Proxy/Admin Console" Settings keycloak #21564 Upgrade to Infinispan 14.0.13.Final keycloak #22452 Ask admins to install the Oracle Database driver separately keycloak #22500 Correct Getting Started guide keycloak #22745 Upgrade to Quarkus 3.2.5.Final keycloak dist/quarkus #22762 Provide support for determining community/product guides keycloak docs #22793 Remove log-level property for `ClassTransformingBuildStep` in Quarkus keycloak dist/quarkus #22795 Error message when JDBC driver is missing is not helpful keycloak #22800 Blank Java adapter section in Securing Apps Guide keycloak #22871 Operator guide screen shot should show fast channel keycloak #23067 Add "LinkedIn (deprecated)" provider to the DEPRECATED profile keycloak identity-brokering Bugs #10981 Keycloak "forgets" ui_locales parameter when using Reset Password functionality keycloak authentication #12137 IdP Mappers ignored when performing external -> internal token exchange keycloak token-exchange #19954 Admin UI hangs with many subgroups keycloak admin/ui #20005 JavaScript Auth ## Temporal plans authentication and authorization for Temporal Web and Temporal Cloud DevFeed: [Temporal plans authentication and authorization for Temporal Web and Temporal Cloud]() Original publisher: [Read original article]() Author: Shawn Wang Published: 2020-11-06T04:00:00Z Content type: article Language: en Sources: [Temporal Blog]() Topics: [Authentication](), [Authorization](), [Security](), [OAuth](), [OpenID connect (OIDC)](), [Requirements](), [TLS (Transport Layer Security)](), [Self-hosted](), [proxy](), [LDAP](), [saml](), [Cloud]() Tags: [authentication](), [authorization](), [cloud](), [communication](), [grafana](), [ldap](), [oauth](), [oidc](), [product-news](), [proxy](), [published](), [release](), [requirements](), [reverse-proxy](), [security](), [self-hosted](), [temporal](), [update]() ### AI overview Temporal describes its planned authentication and authorization layer for Temporal Web. The feature is not yet released, and the team is seeking beta testers while evaluating requirements, comparable products, and support for self-hosted and Temporal Cloud deployments. ### Source excerpt Hey Temporal community, it's Friday again! It's been a long week with ahem a lot of other things going on in real life, but work has continued apace on Temporal. ## What's Coming To Keycloak DevFeed: [What's Coming To Keycloak]() Original publisher: [Read original article]() Author: Stian Thorgersen Published: 2019-09-03T00:00:00Z Content type: opinion Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [account](), [React](), [WebAuthn](), [Kubernetes](), [Operator Lifecycle Manager](), [API](), [Encryption](), [LDAP](), [health checks](), [Testing]() Tags: [account](), [api](), [authentication](), [automated](), [console](), [encryption](), [health-checks](), [idm](), [kerberos](), [keycloak](), [kubernetes](), [kubernetes-secrets](), [ldap](), [openid-connect](), [operator](), [password](), [rest-api](), [saml](), [software](), [sso](), [usability](), [user-experience](), [vault]() ### AI overview Keycloak's 2019 roadmap outlines planned work on a new React-based account console, WebAuthn authentication, a Kubernetes operator, external vault integration, user profiles, metrics and health checks, and improved automated testing and builds. ### Source excerpt New Account Console and Account REST API The current account console is getting dated. It is also having issues around usability and being hard to extend. For this reason we had the UXD team at Red Hat develop wireframes for a new account console. The new console is being implemented with React.js providing a better user experience as well as making it easier to extend and customise. JIRA - Account Console JIRA - Account REST API WebAuthn We are working towards adding WebAuthn support both for two factor authentication and passwordless experience. This task is not as simple as adding an authenticator for WebAuth, but will also require work on improving authentication flows and the account console. Design proposal - Authentication flow improvements Design proposal - WebAuthn Authenticator Design proposal - WebAuthn Two factor JIRA - Two factor JIRA - Passwordless Operator Operators are becoming an important way to manage software running on Kubernetes and we are working on an operator for Keycloak. The aim is to have an operator published on OperatorHub.io soon which provides basic install and seamless upgrade capabilities. This will be based on the awesome work done by the Red Hat Integreatly team. JIRA Integreatly Keycloak Operator Vault At the moment to keep credentials such as LDAP bind credentials more secure it is required to encrypt the whole database. This can be complex and can also have a performance overhead. We are working towards enabling loading credentials, such as LDAP bind credential and SMTP password, from an external vault. We're providing a built-in integration with Kubernetes secrets as well as an SPI allowing integrating with any vault provider. In the future we will also provide the option to encrypt other more dynamic credentials at rest in the database. JIRA - Vault JIRA - Encryption at rest User Profile Currently there's no single place to define user profiles for a realm. To resolve this we are planning to introduce the Profile SPI, which w ## September 2012 Meeting Minutes DevFeed: [September 2012 Meeting Minutes]() Original publisher: [Read original article]() Published: 2012-10-03T00:00:00Z Content type: news Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [Website](), [jira](), [LDAP](), [migration](), [Deployment](), [3D graphics](), [LLVM]() Tags: [3d-graphics](), [deployment](), [free](), [jira](), [just](), [ldap](), [llvm](), [migration](), [open-source](), [os](), [react](), [reactos](), [recaptcha](), [version](), [website](), [win32](), [winapi]() ### AI overview ReactOS meeting minutes from September 27, 2012 cover website and Typo3 deployment progress, RosBE release and build testing, registration alternatives, and plans to address outdated Mesa and Gallium3D integration challenges. ### Source excerpt 2012-09-27 19:00 UTC freenode, #reactos-meeting Proceedings Meeting started at 19:17 by Aleksey Bragin 0. Website progress, plan for the next month. 1. Next RosBE release - recent status and what will come next. 2. Gallium3D poor performance - what to do. 3. CIA.vc replacement. Point 0 Aleksey Bragin summarized the work done since the last meeting, including setting up an LDAP mirror that Jira could use to authenticate against. ## August 2012 Meeting Minutes DevFeed: [August 2012 Meeting Minutes]() Original publisher: [Read original article]() Published: 2012-09-03T00:00:00Z Content type: article Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [jira](), [LDAP](), [Testing](), [Oracle-VM-VirtualBox]() Tags: [free](), [jira](), [open-source](), [os](), [react](), [reactos](), [release](), [required](), [testing](), [virtualbox](), [win32](), [winapi]() ### AI overview Meeting minutes covering ReactOS website transition issues, Jira integration, LDAP-based authentication, VirtualBox registry corruption affecting testing, MSVC build work, developer contracts, and release feasibility. ### Source excerpt 2012-08-30 19:00 UTC dev.reactos.org, #meeting Proceedings Meeting started at 19:13 by Aleksey Bragin Point 0: Website status Point 1: ROS Testing and Bugs Point 2: Developer Contracts Point 3: State of Trunk and Release Feasibility Point 0 Ziliang Guo had earlier reported that Atlassian's documentation was misleading with respect to Jira integration and did not actually permit what the team was trying to achieve. This was only discovered after Ziliang submitted a support request to Atlassian.