# saml Security Assertion Markup Language (SAML) is an XML-based protocol and framework for exchanging authentication, authorization, and other security information between online business partners. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak 26.7.4 released DevFeed: [Keycloak 26.7.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-09-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Quarkus](), [MariaDB](), [MySQL](), [saml]() Tags: [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.4 was released on September 16, 2026. The release includes security fixes for several CVEs, an upgrade to Quarkus 3.33.3.2, and fixes for performance, testing, documentation, administration, and UI issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state Enhancements #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus Bugs #49635 Performance issue with 26.6.2 dist/quarkus #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci #52015 New links errors for https://quarkus.io/guides docs #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan #52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 -- SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus #52241 Clicking on a sub group in the admin console throws an exception admin/ui #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite ## How to migrate from a custom auth system to a third-party provider DevFeed: [How to migrate from a custom auth system to a third-party provider]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [migration](), [passwords](), [Single sign-on (SSO)](), [saml]() Tags: [auth](), [how-to](), [migration](), [password](), [rollback](), [saml](), [sso](), [third-party]() ### AI overview A guide to moving from a custom authentication system to a third-party provider. It explains how password-hash portability, SSO callback control, and an inventory of existing authentication components determine the migration strategy and cutover plan. ### Source excerpt What is actually portable, how to import password hashes without forcing a reset, and how to cut over with a rollback you can trust. ## Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM DevFeed: [Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [saml](), [Security]() Tags: [auth0](), [enterprise](), [oidc](), [provisioning](), [saml](), [sso]() ### AI overview This comparison examines Auth0 Enterprise Connect, which is in beta, alongside WorkOS for enterprise SSO and SCIM. It explains how Auth0 preserves an existing authorization server while adding enterprise identity capabilities, and highlights differences in SCIM direction, plan tier, pricing, and access requirements. ### Source excerpt Auth0's beta keeps the authorization server you already run and adds the enterprise surface around it. The differences from WorkOS show up in SCIM direction, plan tier, and which pricing table you are actually reading. ## Keycloak 26.7.1 released DevFeed: [Keycloak 26.7.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [saml](), [LDAP](), [WebAuthn]() Tags: [2026](), [authorization](), [cve](), [extension](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.1 is released with multiple security fixes addressing authorization bypasses, privilege escalation, protocol validation issues, and other vulnerabilities, along with bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers Bugs #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn #50750 Clustering test broken in 26.7 release branch ci #50836 Kustomize cluster-wide faulty Role&RoleBinding operator #50850 New Password is commited when multiple Password Reset is detected authentication #50882 500 when client requests `organization` scope with it already set to `Default` authentication #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core ## Keycloak 26.7.0 released DevFeed: [Keycloak 26.7.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [Authentication](), [Authorization](), [Security](), [OAuth 2.0](), [saml]() Tags: [api](), [authentication](), [authorization](), [deprecated](), [haproxy](), [high-availability](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [openid-connect](), [persistence](), [provisioning](), [release](), [saml](), [security](), [sso](), [traefik]() ### AI overview Keycloak 26.7.0 introduces preview support for SCIM-based user provisioning and simplified multi-cluster high availability, along with enhanced HAProxy and Traefik reverse-proxy guidance and step-up authentication for SAML clients. The release also adds a more secure, OAuth 2.0-compliant Identity Brokering API v2, while V1 remains enabled by default but is deprecated. OID4VCI improvements remain experimental. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Automate user provisioning with the SCIM API (preview) Simplified multi-cluster high availability without external caches (preview) Enhanced reverse proxy guides with blueprints for HAProxy and Traefik Step-up authentication for SAML clients Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards Stronger security for the Identity Brokering API The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design: Client-level authorization -- access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. Confidential clients only -- public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. OAuth 2.0 compliant -- the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. Session-based token storage -- a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default. For more information, see the Identity Brokering APIs chapter in the Server Developer Guide. Progress on Verifiable Credentials (OID4VCI) (experimental) Verifiable Credentials (OID4VCI) allow organizations to issue tampe ## Organization Groups: Structure Your Organizations with Hierarchical Group Management DevFeed: [Organization Groups: Structure Your Organizations with Hierarchical Group Management]() Original publisher: [Read original article]() Author: Vlasta Ramik Published: 2026-04-29T00:00:00Z Content type: tutorial Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [structure](), [Authentication](), [OpenID connect (OIDC)](), [saml]() Tags: [authentication](), [b2b](), [idm](), [kerberos](), [keycloak](), [ldap](), [oidc](), [openid-connect](), [saml](), [sso](), [structure]() ### AI overview Keycloak 26.6.0 introduces Organization Groups, enabling isolated hierarchical groups within each organization. The article explains how to create and reorganize group hierarchies, assign users through identity-provider mappers, and include organization group memberships in OIDC tokens and SAML assertions. ### Source excerpt Introduced in Keycloak 26.6.0, Organization Groups bring hierarchical group management to the Organizations feature. While Organizations already let you model Business-to-Business (B2B) relationships where external companies, partners, or departments each manage their own users, Organization Groups take this further by letting you organize members within each organization into logical teams, departments, or any structure that fits your needs. Why Organization Groups? Before Organization Groups, structuring members within an organization required workarounds using realm-level groups, which are shared across the entire realm. This creates problems in multi-tenant scenarios: if Organization A and Organization B both need an "Engineering" group, they'd collide at the realm level. Organization Groups solve this by giving each organization its own isolated group hierarchy. Organization A's /Engineering/Backend and Organization B's /Engineering/Backend are completely separate groups with their own members, attributes, and identifiers. No naming conflicts, no cross-organization leakage. Creating a Group Hierarchy Groups can be nested to mirror real-world organizational structures: /Engineering /Engineering/Backend /Engineering/Frontend /Sales /Sales/APAC /Sales/EMEA /Sales/LATAM /Sales/NA Creating groups is straightforward: navigate to your organization, click the Groups tab, and click Create group. To build hierarchies, select a parent group before creating a child group, or use Move to to reorganize existing groups. Automatic Group Assignment via Identity Providers One of the most powerful capabilities is automatic group assignment during federated authentication. When an identity provider is linked to an organization, two mapper types are available: Hardcoded Group assigns every user authenticating through the IdP to a specific organization group. Useful for scenarios like "everyone from this corporate IdP goes into the Engineering team." Advanced Claim to Group maps use ## Keycloak 26.5.5 released DevFeed: [Keycloak 26.5.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-03-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [saml](), [Security](), [Authentication]() Tags: [2026](), [authentication](), [broker](), [cve](), [download](), [idm](), [idp](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [login](), [migration-guide](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.5.5 was released on March 5, 2026. The release includes security fixes for SAML broker authentication bypass, disabled identity provider enforcement, disabled SAML identity provider login, and encrypted assertion injection. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login #46912 CVE-2026-2092 saml broker encrypted assertion injection ## Keycloak 26.5.4 released DevFeed: [Keycloak 26.5.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-02-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [saml](), [OpenID connect (OIDC)](), [upgrade]() Tags: [2026](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso](), [upgrade]() ### AI overview Keycloak 26.5.4 is released with security fixes, protocol enhancements, and bug fixes. The release includes fixes for SAML, OIDC, authorization, Docker Registry Protocol, organizations, clustering, caching, and related components. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol Enhancements #46090 New key affinity for session ids Bugs #44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc #45065 Client deletion timeout due to large number of client roles storage #45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml #45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc #45874 Disabled organizations still resolve in organization-aware login flows organizations #45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator #45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan #46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan #46150 Move upgrading note for SAML to 26.5.4 docs #46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript #46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan #46303 JWT Authorization Grant: Always getting "Token was issued too far in the past to be used now" for EntraID issued tokens oidc #46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gso ## Mintlify for Enterprise DevFeed: [Mintlify for Enterprise]() Original publisher: [Read original article]() Author: Hahnbee Lee Published: 2026-02-11T00:00:00Z Content type: release Language: en Sources: [Mintlify Blog]() Topics: [Documentation](), [Access Control](), [Single sign-on (SSO)](), [saml](), [Security](), [okta](), [anthropic](), [Microsoft](), [coinbase]() Tags: [access-control](), [announcements](), [anthropic](), [coinbase](), [documentation](), [enterprise](), [like](), [microsoft](), [security]() ### AI overview Mintlify introduces enterprise-focused features for documentation teams, including self-serve SSO through Okta and Microsoft Entra via SAML, role-based access control, viewer roles, and security workflow improvements. The article also describes how companies use Mintlify documentation for product adoption, support, revenue, and AI systems. ### Source excerpt How companies like Anthropic, Coinbase, HubSpot, Fidelity, PayPal, and Microsoft use Mintlify to run documentation as core infrastructure in an AI-driven, revenue-critical world. ## Keycloak 26.4.7 released DevFeed: [Keycloak 26.4.7 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-12-01T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [saml](), [Authorization]() Tags: [bugs](), [headers](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [permissions](), [quarkus](), [release](), [resolved](), [saml](), [sso](), [upgrade]() ### AI overview Keycloak 26.4.7 is released with documentation and Quarkus 3.27.1 upgrades, plus fixes for SAML initialization errors and persistent group permissions during concurrent membership changes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #43156 [Docs] Warn users about printing headers in HTTP access logs docs #43643 Upgrade to Quarkus 3.27.1 dist/quarkus Bugs #44438 Intermittent ConcurrentModificationException during SAML initialization causing status code 400 for clients saml #44480 Wrong persistent group permissions when multiple group membership changes happen in the same request core ## 10 reasons your CISO will love Temporal Cloud DevFeed: [10 reasons your CISO will love Temporal Cloud]() Original publisher: [Read original article]() Author: Tim Imkin Published: 2025-09-30T00:00:00Z Content type: opinion Language: en Sources: [Temporal Blog]() Topics: [Cloud](), [Security](), [Encryption](), [Firewall](), [Single sign-on (SSO)](), [Access Control](), [MFA](), [certificates](), [TLS (Transport Layer Security)](), [saml](), [ci](), [Serverless]() Tags: [access-control](), [api](), [api-keys](), [aws](), [certificates](), [ci](), [cloud](), [compliance](), [data](), [firewall](), [gdpr](), [google-cloud](), [mfa](), [network](), [permissions](), [soc](), [soc-2](), [temporal-concepts]() ### AI overview This article presents ten security and compliance characteristics of Temporal Cloud for CISO review. It describes client-side encryption with customer-controlled keys, outbound-only connectivity, mutual TLS, SAML SSO, RBAC, private connectivity options, secure debugging, and stated SOC 2, HIPAA, and GDPR support. ### Source excerpt Discover 10 reasons CISOs choose Temporal Cloud: no plaintext data, no inbound connectivity, mTLS with your CA, private links, SOC 2/HIPAA, secure debugging. ## Keycloak 25.0.6 released DevFeed: [Keycloak 25.0.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-09-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [saml](), [Quarkus](), [WebAuthn]() Tags: [bugs](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [saml](), [sso]() ### AI overview Keycloak 25.0.6 is released with resolved issues affecting network responses, user properties, WebAuthn login flows, hostname paths, client annotations, realm imports, LDAP searches, and SAML security. The release also addresses two CVEs. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #30604 Network response was not OK. saml #31165 Re-enabling a temporarily locked user (brute-force) deletes all user properties and attributes admin/ui #32100 Remember Me with External Infinispan is not works properly infinispan #32578 WebAuthn Flows Broken in login.v2 login/ui #32643 Dots are not allowed in the path in Hostname v2 dist/quarkus #32731 KeyCloak Admin Client uses non-standard `@NoCache` annotation which is an issue for Quarkus admin/client-java #32799 Realm import fails when client configures default_acr values import-export #32870 Increased DB activity due to changes in LDAPStorageManager.searchForUserByUserAttributeStream ldap #33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect #33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak ## Keycloak 25.0.5 released DevFeed: [Keycloak 25.0.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-09-10T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [saml](), [migration]() Tags: [adapter](), [bugs](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [resolved](), [saml](), [sso]() ### AI overview Keycloak 25.0.5 was released on September 10, 2024. The release notes provide download and upgrade guidance and list resolved issues, including a SAML adapter session-listener problem and CVE-2024-7341 involving session fixation in SAML adapters. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #32084 SAML adapter IdMapperUpdaterSessionListener not executed when session ID changes adapter/saml #32754 CVE-2024-7341 Session fixation in the SAML adapters adapter/saml ## Keycloak 25.0.0 released DevFeed: [Keycloak 25.0.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-06-10T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [Release notes](), [version](), [upgrade](), [Java](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Primer](), [saml](), [Security]() Tags: [deprecated](), [design-system](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [openjdk](), [release](), [release-notes](), [saml](), [security](), [sso](), [upgrade](), [version]() ### AI overview Keycloak 25.0.0 removes the Account Console v2 theme and most Java adapters, adds OpenJDK 21 support while deprecating OpenJDK 17, updates the consoles to PatternFly 5, and makes Argon2 the default password-hashing algorithm outside FIPS environments. ### Source excerpt To download the release go to Keycloak downloads. Highlights Account Console v2 theme removed The Account Console v2 theme has been removed from Keycloak. This theme was deprecated in Keycloak 24 and replaced by the Account Console v3 theme. If you are still using this theme, you should migrate to the Account Console v3 theme. Java 21 support Keycloak now supports OpenJDK 21, as we want to stick to the latest LTS OpenJDK versions. Java 17 support is deprecated OpenJDK 17 support is deprecated in Keycloak, and will be removed in a following release in favor of OpenJDK 21. Most of Java adapters removed As stated in the release notes of previous Keycloak version, the most of Java adapters are now removed from the Keycloak codebase and downloads pages. For OAuth 2.0/OIDC, this includes removal of the Tomcat adapter, WildFly/EAP adapter, Servlet Filter adapter, KeycloakInstalled desktop adapter, the jaxrs-oauth-client adapter, JAAS login modules, Spring adapter and SpringBoot adapters. You can check our older post for the list of some alternatives. For SAML, this includes removal of the Tomcat adapter and Servlet filter adapter. SAML adapters are still supported with WildFly and JBoss EAP. The generic Authorization Client library is still supported, and we still plan to support it. It aims to be used in combination with any other OAuth 2.0 or OpenID Connect libraries. You can check the quickstarts for some examples where this authorization client library is used together with the 3rd party Java adapters like Elytron OIDC or SpringBoot. You can check the quickstarts also for the example of SAML adapter used with WildFly. Upgrade to PatternFly 5 In Keycloak 24, the Welcome page is updated to use PatternFly 5, the latest version of the design system that underpins the user interface of Keycloak. In this release, the Admin Console and Account Console are also updated to use PatternFly 5. If you want to extend and customize the Admin Console and Account Console, review the ch ## SSO for Pay-as-you-go Customers DevFeed: [SSO for Pay-as-you-go Customers]() Original publisher: [Read original article]() Author: Vivek Viswanathan Published: 2024-03-21T03:27:00Z Content type: release Language: en Sources: [Heroku]() Topics: [Single sign-on (SSO)](), [Heroku](), [Security](), [Authentication](), [saml]() Tags: [authentication](), [heroku](), [news](), [saml](), [security](), [sso]() ### AI overview Heroku introduces Single Sign-On for pay-as-you-go customers. The feature centralizes access through an identity provider or custom SAML 2.0 authentication, with automatic IdP provisioning and configurable default roles for new users. ### Source excerpt Today, we're pleased to introduce a security feature addition for Heroku pay-as-you-go customers: Single Sign-On (SSO). SSO makes it easy to centralize and manage access to all the various tools and services used by your employees. Previously, SSO was only available for Heroku Enterprise. SSO improves the employee experience in several ways. You can use [...] The post SSO for Pay-as-you-go Customers appeared first on Heroku. ## SAML Protocol DevFeed: [SAML Protocol]() Original publisher: [Read original article]() Author: Keith Richards Published: 2023-11-29T17:55:03Z Content type: article Language: en Sources: [Clever]() Topics: [saml](), [Single sign-on (SSO)](), [Authentication](), [Authorization](), [Security]() Tags: [authentication](), [authorization](), [oauth2](), [protocol](), [saml](), [security](), [sso](), [standard](), [third-party-applications]() ### AI overview This article explains SAML as an open standard for exchanging authentication and authorization data between parties. It describes SAML's role in single sign-on, its history through SAML 2.0, and the roles of service providers and identity providers. ### Source excerpt A tool for Identity Federation Security Assertion Markup Language, or SAML, is an open standard for exchanging authentication and authorization data between two parties. It's a common strategy for single sign-on (SSO), allowing users to sign in once and authenticate with multiple third party applications. Similar to OAuth2.0, SAML promotes data security by preventing direct [...] The post SAML Protocol appeared first on Clever Engineering Blog. ## Keycloak 23.0.1 released DevFeed: [Keycloak 23.0.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2023-11-29T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [OpenID connect (OIDC)](), [saml](), [certificates](), [public key]() Tags: [bugs](), [http](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [migration-guide](), [oidc](), [openid-connect](), [public-key](), [release](), [saml](), [sso](), [update](), [x509]() ### AI overview Keycloak 23.0.1 was released on November 29, 2023. The release notes provide download and upgrade guidance and list resolved issues involving LDAP user storage, Firefox storage access, the admin console, X509 certificate validation, SAML, the Operator, group search, and token refresh. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #23841 Users page with LDAP User Storage Provider Cannot read properties of undefined admin/ui #23872 Attempt to request storage access in Firefox oidc #24261 "Unlink users"-Option greyed out in ldap federation admin/ui #24958 Error handling in admin console when update of user fails due the 400 HTTP error code admin/ui #24961 Keycloak not able to handle multiple validating X509 certificates when public key are the same saml #24984 Operator is missing CRDs metadata in CSV operator #25008 Group search when creating user admin/ui #25022 NPE in checkAndBindMtlsHoKToken on Token Refresh when using SuppressRefreshTokenRotationExecutor and Certificate Bound Token oidc ## Keycloak 21.0.0 released DevFeed: [Keycloak 21.0.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2023-02-23T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [saml](), [Cordova](), [Microsoft](), [Hibernate](), [JavaScript](), [PostgreSQL]() Tags: [cordova](), [hibernate](), [idm](), [javascript](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [migration-guide](), [openid-connect](), [policies](), [postgresql](), [release](), [saml](), [sso](), [update]() ### AI overview Keycloak 21.0.0 is released with new features, enhancements, documentation updates, and resolved issues. Changes include Microsoft Authenticator support, multi-hosted-domain support for GoogleIdentityProvider, Cordova redirect URI configuration, SAML signature updates, and storage improvements. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues New features #11698 Add an option allowing to disable client registration access token rotation keycloak #15271 Add support for Microsoft Authenticator keycloak #16107 Short verification_uri for Device Authorization Request keycloak #16787 support multi hosted-domain in `GoogleIdentityProvider` keycloak #17037 Allow configuring of redirectUri for the cordova adapter keycloak adapter/javascript Enhancements #1738 Deprecate SHA1 based algorithms for SAML signatures keycloak-documentation #1743 Documentation of some options of SAML IDP is not up-to-date keycloak-documentation #8820 Official Support for Microsoft mobile authenticator app keycloak #8982 Blacklist false positive rate could be set a lot lower. keycloak #9008 Update client with registration access token gained by client registration keycloak authorization-services #9017 Pre-authorization hook for client policies keycloak #9144 Remove Hashicorp Support keycloak dist/quarkus #9388 Global lock interface keycloak storage #9420 Use bulk deletes in HotRod store keycloak storage #9699 Include list of possible option values in help messages. keycloak dist/quarkus #10018 JPA Map Storage: leverage function-based indexes (Postgresql) keycloak storage #10090 Remove workaround in HotRodUtils#paginateQuery keycloak storage #10376 Add MapKeycloakTransaction.exists(id) method keycloak storage #10988 Remove doubled field from HotRod entities keycloak storage #11744 Remove `session.area().getById(id)` from Map provider methods keycloak storage #12067 Investigate a way to update indexes in no-downtime way for HotRod store keycloak storage #12068 Leverage Infinispan lifespan for ExpirableEntities in HotRod storage keycloak storage #12950 Implement "advanced claim to group" mapping for SAML keycloak #13219 Followup: JPA Map store wants to use `hibernate.integrator_provider ## Securely Implementing IdP-initiated SAML2 Login DevFeed: [Securely Implementing IdP-initiated SAML2 Login]() Original publisher: [Read original article]() Author: info@goteleport.com (Joel Wejdenstål) Published: 2022-10-06T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [saml](), [Single sign-on (SSO)](), [Authentication](), [Security]() Tags: [authentication](), [blog-post](), [deep-dive](), [idp](), [implement](), [login](), [saml](), [security](), [sso]() ### AI overview This tutorial explains the SAML 2.0 protocol, IdP-initiated single sign-on, the roles of identity and service providers, and considerations for implementing the authentication flow securely. ### Source excerpt In this blog post, we'll deep-dive into the SAML2 protocol, how IdP-initiated login works and how to implement it securely. ## Upcoming Changes to GitHub SAML SSO with Teleport DevFeed: [Upcoming Changes to GitHub SAML SSO with Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Drew Nielsen) Published: 2022-10-05T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [saml](), [Single sign-on (SSO)](), [GitHub]() Tags: [availability](), [change](), [enterprise](), [github](), [saml](), [sso](), [update]() ### AI overview Teleport will make GitHub SAML SSO available only in its Enterprise Edition starting with Teleport 11.0. Community Edition users can continue using GitHub SSO without SAML, while users needing SAML-enabled GitHub Enterprise organizations can upgrade or remain on Teleport 10 and earlier. ### Source excerpt An update about an upcoming Changes to GitHub SAML SSO in Teleport Community Edition. ## How to Configure SSO for Amazon RDS Authentication and Authorization DevFeed: [How to Configure SSO for Amazon RDS Authentication and Authorization]() Original publisher: [Read original article]() Author: info@goteleport.com (Janakiram MSV) Published: 2022-05-13T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon RDS](), [Single sign-on (SSO)](), [Authorization](), [okta](), [saml](), [Authentication](), [Amazon Web Services](), [PostgreSQL](), [Amazon EC2]() Tags: [amazon-rds](), [authentication](), [authorization](), [aws](), [how-to](), [okta](), [policies](), [postgresql](), [saml](), [security](), [sso](), [tutorial]() ### AI overview A tutorial explains how to configure single sign-on for Amazon RDS using Okta, SAML, and Teleport. It shows how to map Okta groups to Teleport roles and use role-based access control to restrict access to specific databases, including a sensitive forecast database. ### Source excerpt This post is a tutorial to set up single sign-on (SSO) for Amazon RDS access ## Tutorial: How to Configure SSO for AWS Resources with Okta and SAML DevFeed: [Tutorial: How to Configure SSO for AWS Resources with Okta and SAML]() Original publisher: [Read original article]() Author: info@goteleport.com (Janakiram MSV) Published: 2022-03-29T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Single sign-on (SSO)](), [Amazon Web Services](), [okta](), [saml](), [Amazon EC2](), [ssh](), [VPC]() Tags: [aws](), [ec2](), [how-to](), [okta](), [saml](), [ssh](), [sso](), [tutorial]() ### AI overview This tutorial explains how to configure single sign-on for AWS resources using Okta, SAML, and Teleport. It demonstrates fine-grained SSH access to EC2 instances by mapping Okta users and groups to infrastructure roles and access policies. ### Source excerpt This post explains how to configure SSO for AWS Resources with Okta and SAML. ## Keycloak release plans for 2022 DevFeed: [Keycloak release plans for 2022]() Original publisher: [Read original article]() Author: Stian Thorgersen Published: 2022-03-24T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [Quarkus](), [Kubernetes](), [PostgreSQL](), [CockroachDB](), [openid](), [saml]() Tags: [cockroachdb](), [deprecated](), [end-of-life](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [kubernetes](), [ldap](), [openid-connect](), [postgresql](), [quarkus](), [release](), [releases](), [saml](), [sso]() ### AI overview Keycloak's provisional 2022 release plan aims for quarterly feature releases with more frequent patch releases. It outlines planned changes across Keycloak 18, 19, and 20, including Quarkus and Kubernetes Operator previews, console and store changes, migration support, and removal of deprecated components and adapters. ### Source excerpt December last year was a bit on the crazy side with 3 feature releases of Keycloak (15.1, 16.0, and 16.1). This was down to balancing WildFly upgrades with introduction of the Quarkus dist preview. This year we are planning to bring more predictability to Keycloak releases and are aiming for a quarterly release, with more frequent patch releases in-between. One thing worth highlighting is we have decided to extend the support of the WildFly distribution until September to give everyone more time to migrate. Subject to change: this is a provisional plan, which may change throughout the year. Keycloak 18 - March/April Highlights Enhancements and polishing for the Quarkus distribution Preview of the new Kubernetes Operator for the Quarkus distribution Preview of the new Admin Console Upgrade to Quarkus 2.8.0 Upgrade to WildFly 26.1.0 End of life Ability to upload custom JavaScript providers through REST APIs will be removed Keycloak 19 - June/July Highlights Preview of the new Store New Admin Console is graduated to the default console, while the old Admin Console is deprecated End of life Old Account Console will be removed, but the new Account Console will remain of course Text-based login flows and authenticators will be removed Some OpenID Connect adapters will be removed (adapter deprecation blog post), including: JBoss AS 7 and EAP 6 Fuse 6 and 7 Jetty 9.2 and 9.3 WildFly legacy WildFly Galleon feature pack Some SAML adapters will be removed, including: JBoss AS 7 and EAP 6 Jetty 9.2 and 9.3 WildFly legacy Keycloak 20 - September/October Highlights New store is graduated to the new default store for PostgreSQL and CockroachDB. We will come back with more details on what happens with the old store and support for other database vendors, but rest assured we will give everyone plenty of heads up, and at the minimum the old store will be supported at least until the middle of 2023. End of life WildFly distribution will be removed Legacy Kubernetes Operator will be re ## Single sign-on user experience challenges and integration approaches DevFeed: [Single sign-on user experience challenges and integration approaches]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2022-03-11T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Single sign-on (SSO)](), [User experience (UX)](), [identity and access management](), [OpenID connect (OIDC)](), [saml](), [okta](), [Terraform]() Tags: [authentication](), [identity](), [identity-and-access-management](), [oidc](), [okta](), [saml](), [sso](), [terraform](), [ux]() ### AI overview This article examines user-experience problems with single sign-on, including repeated authentication prompts and redirect flows. It explains how application architectures and integrations using SAML or OIDC make a standardized sign-on experience difficult, and discusses identity-provider, access-control, and automation practices. ### Source excerpt A deep dive into the UX of current single sign-on and an overview of possible solutions. [Next page]()