●Change8

26.5.0

📦 keycloakView on GitHub →
✨ 11 features⚡ 1 deprecations🔧 8 symbols

Summary

This release introduces preview features like Workflows and JWT Authorization Grants, enhances administration with organization invitation management, and adds OpenTelemetry support. It also provides documentation updates and security standard compliance improvements.

Migration Steps

  1. Review the changes listed in the upgrading guide: https://www.keycloak.org/docs/latest/upgrading/index.html

✨ New Features

  • Introduction of Workflows (preview) to automate administrative tasks and processes within a realm.
  • JWT Authorization Grants (preview) supporting RFC 7523 for requesting OAuth 2.0 access tokens using external signed JWT assertions.
  • OpenTelemetry support for metrics and logging.
  • Support for authenticating clients with Kubernetes service account tokens to avoid static client secrets (Federated client authentication preview enhancement).
  • CORS enhancements allowing specification of allowed headers via the SPI option <code>spi-cors--default--allowed-headers</code> for overall configuration.
  • CORS enhancements allowing specification of allowed headers via client registration access policies for OpenID Connect Dynamic Client Registration.
  • Logout confirmation page option in client logout configuration, showing a "You are logged out" page upon successful logout.
  • Ability to hide OpenID Connect scopes from the discovery endpoint by disabling "Include in OpenID Provider Metadata".
  • Organization invitation management via Admin Console and REST API (view, resend, delete invitations).
  • New persistent storage for organization invitations in the database.
  • New event <code>USER_SESSION_DELETED</code> fired for each expired user session.

Affected Symbols

OpenID Connect v1.0 identity provider (configuration updated for JWT Authorization Grant)JWT Authorization Grant identity provider (new)External to internal token exchange V1 (deprecated in favor of JWT Authorization Grant)OpenID Connect Dynamic Client Registration (CORS headers configuration)spi-cors--default--allowed-headers (new SPI option)Organizations REST API endpoints under <code>/admin/realms/{realm}/orgs/{orgId}/invitations</code>Admin Console (Invitations tab for organization management)USER_SESSION_DELETED (new event)

⚡ Deprecations

  • JWT Authorization Grant is recommended as an alternative to External to internal token exchange V1.