fix(deps): update dependency org.keycloak:keycloak-services to v25 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.keycloak:keycloak-services (source)	21.0.0 -> 25.0.0

GitHub Vulnerability Alerts

CVE-2023-0264

Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.

CVE-2023-2585

Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.

CVE-2022-4361

AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).

AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.

CVE-2023-2422

When a Keycloak server is configured to support mTLS authentication for OAuth/OpenID clients, it does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client and therefore access data that belongs to other clients.

CVE-2022-2232

A flaw was found in the Keycloak package. This flaw allows an attacker to benefit from an LDAP query and access existing usernames in the server.

CVE-2023-6134

Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.

CVE-2023-6291

An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.

The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "www%2ekeycloak%2eorg%2fapp%2f:y@example.com" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.

Acknowledgements

Karel Knibbe

CVE-2024-2419

An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.

CVE-2023-3597

Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.

CVE-2023-6717

Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:).

Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission.

Acknowledgements:

Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.

CVE-2023-6544

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.

Acknowledgements:

Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security.

CVE-2023-6484

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection.

Acknowledgements:
Special thanks toTheresa Henze for reporting this issue and helping us improve our security.

CVE-2024-1249

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Acknowledgements

Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project.

CVE-2024-1132

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

Acknowledgements:

Special thanks to Axel Flamcourt for reporting this issue and helping us improve our project.

CVE-2023-6787

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.

CVE-2023-0657

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

CVE-2024-4540

A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.

CVE-2024-3656

Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

Acknowledgements:
Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

CVE-2021-3754

Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.

CVE-2024-1722

In any realm set with "User (Self) registration" a user that is registered with a username in email format can be "locked out" (denied from logging in) using his username.

CVE-2024-4629

If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.

Acknowledgements:
Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

CVE-2024-8883

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

CVE-2024-7341

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

CVE-2024-10270

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

---

Release Notes

keycloak/keycloak (org.keycloak:keycloak-services)

v25.0.0

Compare Source

Highlights

Account Console v2 theme removed

The Account Console v2 theme has been removed from Keycloak. This theme was deprecated in Keycloak 24 and replaced by the Account Console v3 theme. If you are still using this theme, you should migrate to the Account Console v3 theme.

Java 21 support

Keycloak now supports OpenJDK 21, as we want to stick to the latest LTS OpenJDK versions.

Java 17 support is deprecated

OpenJDK 17 support is deprecated in Keycloak, and will be removed in a following release in favor of OpenJDK 21.

Most of Java adapters removed

As stated in the release notes of previous Keycloak version, the most of Java adapters are now removed from the Keycloak codebase and downloads pages.

For OAuth 2.0/OIDC, this includes removal of the Tomcat adapter, WildFly/EAP adapter, Servlet Filter adapter, KeycloakInstalled desktop adapter, the jaxrs-oauth-client adapter, JAAS login modules, Spring adapter and SpringBoot adapters. You can check our older post for the list of some alternatives.

For SAML, this includes removal of the Tomcat adapter and Servlet filter adapter. SAML adapters are still supported with WildFly and JBoss EAP.

The generic Authorization Client library is still supported, and we still plan to support it. It aims to be used in combination with any other OAuth 2.0 or OpenID Connect libraries. You can check the quickstarts for some examples where this authorization client library is used together with the 3rd party Java adapters like Elytron OIDC or SpringBoot. You can check the quickstarts also for the example of SAML adapter used with WildFly.

Upgrade to PatternFly 5

In Keycloak 24, the Welcome page is updated to use PatternFly 5, the latest version of the design system that underpins the user interface of Keycloak. In this release, the Admin Console and Account Console are also updated to use PatternFly 5. If you want to extend and customize the Admin Console and Account Console, review the changes in PatternFly 5 and update your customizations accordingly.

Argon2 password hashing

Argon2 is now the default password hashing algorithm used by Keycloak in a non-FIPS environment.

Argon2 was the winner of the 2015 password hashing competition and is the recommended hashing algorithm by OWASP.

In Keycloak 24 the default hashing iterations for PBKDF2 were increased from 27.5K to 210K, resulting in a more than 10 times increase in the amount of CPU time required to generate a password hash. With Argon2 it is possible to achieve better security, with almost the same CPU time as previous releases of Keycloak. One downside is Argon2 requires more memory, which is a requirement to be resistant against GPU attacks. The defaults for Argon2 in Keycloak requires 7MB per-hashing request. To prevent excessive memory and CPU usage, the parallel computation of hashes by Argon2 is by default limited to the number of cores available to the JVM. To support the memory intensive nature of Argon2, we have updated the default GC from ParallelGC to G1GC for a better heap utilization.

New Hostname options

In response to the complexity and lack of intuitiveness experienced with previous hostname configuration settings, we are proud to introduce Hostname v2 options.

We have listened to your feedback, tackled the tricky issues, and created a smoother experience for managing hostname configuration. Be aware that even the behavior behind these options has changed and requires your attention - if you are dealing with custom hostname settings.

Hostname v2 options are supported by default, as the old hostname options are deprecated and will be removed in the following releases. You should migrate to them as soon as possible.

New options are activated by default, so Keycloak will not recognize the old ones.

For information on how to migrate, see the Upgrading Guide.

Persistent user sessions

Previous versions of Keycloak stored only offline user and offline client sessions in the databases. The new feature persistent-user-session stores online user sessions and online client sessions not only in memory, but also in the database. This will allow a user to stay logged in even if all instances of Keycloak are restarted or upgraded.

The feature is a preview feature and disabled by default. To use it, add the following to your build command:

bin/kc.sh build --features=persistent-user-session ...

For more details see the Enabling and disabling features guide. The sizing guide contains a new paragraph describing the updated resource requirements when this feature is enabled.

For information on how to upgrade, see the Upgrading Guide.

Cookies updates

SameSite attribute set for all cookies

The following cookies did not use to set the SameSite attribute, which in recent browser versions results in them defaulting to SameSite=Lax:

• KC_STATE_CHECKER now sets SameSite=Strict

• KC_RESTART now sets SameSite=None

• KEYCLOAK_LOCALE now sets SameSite=None

• KEYCLOAK_REMEMBER_ME now sets SameSite=None

The default value SameSite=Lax causes issues with POST based bindings, mostly applicable to SAML, but also used in some OpenID Connect / OAuth 2.0 flows.

Removing KC_AUTH_STATE cookie

The cookie KC_AUTH_STATE is removed and it is no longer set by the Keycloak server as this server no longer needs this cookie.

Deprecated cookie methods removed

The following APIs for setting custom cookies have been removed:

• ServerCookie - replaced by NewCookie.Builder

• LocaleSelectorProvider.KEYCLOAK_LOCALE - replaced by CookieType.LOCALE

• HttpCookie - replaced by NewCookie.Builder

• HttpResponse.setCookieIfAbsent(HttpCookie cookie) - replaced by HttpResponse.setCookieIfAbsent(NewCookie cookie)

Addressed 'You are already logged in' for expired authentication sessions

The Keycloak 23 release provided improvements for when a user is authenticated in parallel in multiple browser tabs. However, this improvement did not address the case when an authentication session expired. Now for the case when user is already logged-in in one browser tab and an authentication session expired in other browser tabs, Keycloak is able to redirect back to the client application with an OIDC/SAML error, so the client application can immediately retry authentication, which should usually automatically log in the application because of the SSO session. For more details, see Server Administration Guide authentication sessions.

Lightweight access token to be even more lightweight

In previous releases, the support for lightweight access token was added. In this release, we managed to remove even more built-in claims from the lightweight access token. The claims are added by protocol mappers. Some of them affect even the regular access tokens or ID tokens as they were not strictly required by the OIDC specification.

• Claims sub and auth_time are added by protocol mappers now, which are configured by default on the new client scope basic, which is added automatically to all the clients. The claims are still added to the ID token and access token as before, but not to lightweight access token.

• Claim nonce is added only to the ID token now. It is not added to a regular access token or lightweight access token. For backwards compatibility, you can add this claim to an access token by protocol mapper, which needs to be explicitly configured.

• Claim session_state is not added to any token now. It is still possible to add it by protocol mapper if needed. There is still the other dedicated claim sid supported by the specification, which was available in previous versions as well and which has exactly the same value.

For more details, see the Upgrading Guide..

Support for application/jwt media-type in token introspection endpoint

You can use the HTTP Header Accept: application/jwt when invoking a token introspection endpoint. When enabled for a particular client, it returns a claim jwt from the token introspection endpoint with the full JWT access token, which can be useful especially for the use-cases when the client calling introspection endpoint used lightweight access token. Thanks to Thomas Darimont for the contribution.

Password policy for check if password contains Username

Keycloak supports a new password policy that allows you to deny user passwords which contains the user username.

Required actions improvements

In the Admin Console, you can now configure some required actions in the Required actions tab of a particular realm. Currently, the Update password is the only built-in configurable required action. It supports setting Maximum Age of Authentication, which is the maximum time users can update their password by the kc_action parameter (used for instance when updating password in the Account Console) without re-authentication. The sorting of required actions is also improved. When there are multiple required actions during authentication, all actions are sorted together regardless of whether those are actions set during authentication (for instance by the kc_action parameter) or actions added to the user account manually by an administrator. Thanks to Thomas Darimont and Daniel Fesenmeyer for the contributions.

Passkeys improvements

The support for Passkeys conditional UI was added. When the Passkeys preview feature is enabled, there is a dedicated authenticator available, which means you can select from a list of available passkeys accounts and authenticate a user based on that. Thanks to Takashi Norimatsu for the contribution.

Default client profile for SAML

The default client profile to have secured SAML clients was added. When browsing through client policies of a realm in the Admin Console, you see a new client profile saml-security-profile. When it is used, there are security best practices applied for SAML clients such as signatures are enforced, SAML Redirect binding is disabled, and wildcard redirect URLs are prohibited.

Authenticator for override existing IDP link during first-broker-login

There was new authenticator Confirm override existing link added. This authenticator allows to override linked IDP username for the Keycloak user, which was already linked to different IDP identity before. More details in the Server Administration Guide. Thanks to Lex Cao for the contribution.

OpenID for Verifiable Credential Issuance - experimental support

There is work in progress on the support of OpenID for Verifiable Credential Issuance (OID4VCI). Right now, this is still work in progress, but things are being gradually added. Keycloak can act as an OID4VC Issuer with support of Pre-Authorized code flow. There is support for verifiable credentials in the JWT-VC, SD-JWT-VC and VCDM formats. Thanks to the members of the OAuth SIG groups for the contributions and feedback and especially thanks to Stefan Wiedemann, Francis Pouatcha, Takashi Norimatsu and Yutaka Obuchi.

Searching by user attribute no longer case insensitive

When searching for users by user attribute, Keycloak no longer searches for user attribute names forcing lower case comparisons. The goal of this change was to speed up searches by using Keycloak&#​8217;s native index on the user attribute table. If your database collation is case-insensitive, your search results will stay the same. If your database collation is case-sensitive, you might see less search results than before.

Breaking fix in authorization client library

For users of the keycloak-authz-client library, calling AuthorizationResource.getPermissions(&#​8230;&#​8203;) now correctly returns a List<Permission>.

Previously, it would return a List<Map> at runtime, even though the method declaration advertised List<Permission>.

This fix will break code that relied on casting the List or its contents to List<Map>. If you have used this method in any capacity, you are likely to have done this and be affected.

IDs are no longer set when exporting authorization settings for a client

When exporting the authorization settings for a client, the IDs for resources, scopes, and policies are no longer set. As a result, you can now import the settings from a client to another client.

Management port for metrics and health endpoints

Metrics and health checks endpoints are no longer accessible through the standard Keycloak server port. As these endpoints should be hidden from the outside world, they can be accessed on a separate default management port 9000.

It allows to not expose it to the users as standard Keycloak endpoints in Kubernetes environments. The new management interface provides a new set of options and is fully configurable.

Keycloak Operator assumes the management interface is turned on by default. For more details, see Configuring the Management Interface.

Syslog for remote logging

Keycloak now supports Syslog protocol for remote logging. It utilizes the protocol defined in RFC 5424. By default, the syslog handler is disabled, but when enabled, it sends all log events to a remote syslog server.

For more information, see the Configuring logging guide.

Change to class EnvironmentDependentProviderFactory

The method EnvironmentDependentProviderFactory.isSupported() was deprecated for several releases and has now been removed.

For more details, see the Upgrading Guide.

All cache options are runtime

It is now possible to specify the cache, cache-stack, and cache-config-file options during runtime. This eliminates the need to execute the build phase and rebuild your image due to them.

For more details, see the Upgrading Guide.

High availability guide enhanced

The high availability guide now contains a guide on how to configure an AWS Lambda to prevent an intended automatic failback from the Backup site to the Primary site.

Removing deprecated methods from AccessToken, IDToken, and JsonWebToken classes

In this release, we are finally removing deprecated methods from the following classes:

• AccessToken

• IDToken

• JsonWebToken

For more details, see the Upgrading Guide.

Method getExp added to SingleUseObjectKeyModel

As a consequence of the removal of deprecated methods from AccessToken, IDToken, and JsonWebToken, the SingleUseObjectKeyModel also changed to keep consistency with the method names related to expiration values.

For more details, see the Upgrading Guide.

Support for PostgreSQL 16

The supported and tested databases now include PostgreSQL 16.

Introducing support for Customer Identity and Access Management (CIAM) and Multi-tenancy

In this release, we are delivering Keycloak Organizations as a technology preview feature.

This feature provides a realm with some core CIAM capabilities, which will serve as the baseline for more capabilities in the future to address Business-to-Business (B2B) and Business-to-Business-to-Customers (B2B2C) use cases.

In terms of functionality, the feature is completed. However, we still have work to do to make it fully supported in the next major release. This remaining work is mainly about preparing the feature for production deployments with a focus on scalability. Also, depending on the feedback we get until the next major release, we might eventually accept additional capabilities and add more value to the feature, without compromising its roadmap.

For more details, see Server Administration Guide.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

New features

• #​25940 Support Credentials Issuance through the OID4VCI Protocol oid4vc
• #​25942 Issue Verifiable Credentials in the SD-JWT-VC format oid4vc
• #​25943 Issue Verifiable Credentials in the VCDM format oid4vc
• #​25945 Extend Account Console to support Credentials Issuance Self-Service account/ui
• #​26201 Introduce a new Authenticator to handle duplicate IdP broker links authentication
• #​27673 Hardcoded SAML metadata URL in admin-v2 admin/ui
• #​27728 Reflect new hostname v2 options in Keycloak CR operator
• #​27729 Add documentation for Hostname v2 docs
• #​27730 Release notes and Migration guide for Hostname v2 docs
• #​28030 Create Argon2 password hashing provider
• #​28400 Make RequiredActions configurable
• #​28608 Allow onboarding organization members through a registration invitation link
• #​28750 CLI options to disable encryption and authentication to external Infinispan dist/quarkus
• #​28938 Need inline translation assistance for user profile attribute groups.
• #​29491 Remove Oracle JDBC driver out of the box docs
• #​29539 Add CRUD for organizations to admin client
• #​29627 Expose Authorization Server Metadata Endpoint under /.well-known/oauth-authorization-server to comply with rfc8414 oid4vc
• #​29634 Expose JWT VC Issuer Metadata /.well-known/jwt-vc-issuer to comply with SD-JWT VC Specification oid4vc

Enhancements

• #​11757 Declarative User Profile: local-date validation and html5-date clash user-profile
• #​13113 Conditionally enable and disable CLI options dist/quarkus
• #​16295 JsonSerialization does not load all available modules from the classpath
• #​17530 Add Portuguese translations
• #​19334 Support management port for health and metrics in Quarkus 3 dist/quarkus
• #​20736 uma-ticket returns 403 even though user has access, when User Realm Role isn't present in access Token authorization-services
• #​20792 Make it clear that `Client Offline Token Max` should not be set when `Offline Session Max Limited` is disabled for realm admin/ui
• #​20916 DefaultHttpClientFactory should handle the encoding of the response core
• #​21185 Protocol mapper and client scope for sub claim
• #​21344 Upgrade account theme to PatternFly 5 account/ui
• #​21345 Upgrade admin theme to PatternFly 5 admin/ui
• #​21439 Allow options to support any value in addition to a list of pre-defined values. dist/quarkus
• #​21562 Make sure admin events are not referencing sensitive data from their representation admin/api
• #​21961 Allow to provider password to kcadm (keycloak-admin-cli) via environment variable admin/cli
• #​22436 Query users by 'LDAP_ID' is not working ldap
• #​22711 Enable theme caches by default in start-dev dist/quarkus
• #​24192 Refine how ConfigSource names are being used dist/quarkus
• #​24264 Passkeys: Supporting WebAuthn Conditional UI authentication/webauthn
• #​24466 Look if checks in IntrospectionEndpoint can be simplified oidc
• #​25057 Inconsistent behaviour on getting user permissions using authorization authorization-services
• #​25114 User Profile "Input placeholder" and other annotations - Use Localization keys user-profile
• #​26162 Optimize query batching and result fetching by tuning Hibernate parameters
• #​26443 Show an error message when file does not exist for the `config-file` parameter dist/quarkus
• #​26504 Localization Proposal 2 admin/ui
• #​26654 Initial client policies integration for SAML saml
• #​26657 Map Storage Removal: Remove deprecated model/legacy module storage
• #​26695 Keycloak and MSAD: enabling account in MSAD does not propagate to Keycloak ldap
• #​26713 Refactoring JavaScript code of WebAuthn's authenticators to follow the current Keycloak's JavaScript coding convention authentication/webauthn
• #​27264 Trivy Analysis warnings should be fixed
• #​27433 Clarify format of keys in `additionalOptions` field in the Keycloak CR docs
• #​27442 Use browser router for Account Console account/ui
• #​27481 Edit High Availability guide
• #​27484 Edit 23.0 changes part of Upgrading Guide
• #​27494 Use JDK17 functionality in the KC Operator operator
• #​27508 Use new remote-store options in HA guides
• #​27509 Upgrade to Aurora Postgres 15.5
• #​27515 `ClusterProvider` should no longer be deprecated now that "legacy" is the default
• #​27527 CS and SK localized messages need an update
• #​27544 Expose quarkus syslog logging now GELF is being deprecated from Keycloak dist/quarkus
• #​27545 Simplify handling of profile features in test cases
• #​27549 Make general `cache` options runtime dist/quarkus
• #​27574 Support for script providers when running in embedded mode testsuite
• #​27602 Remove offline session preloading
• #​27614 Remove additional handlers for health and metrics endpoints dist/quarkus
• #​27632 Integrate downstream Upgrading Guide changes into upstream
• #​27696 Upgrade to Quarkus 3.8.2 dist/quarkus
• #​27724 Enable Infinispan metrics by default
• #​27787 Missing API documentation for /admin/realms/{realm}/groups/{group-id}
• #​27871 Upgrade to Infinispan 14.0.26 core
• #​27924 Enable http metrics once Quarkus 3.8.3 is available
• #​27953 Address feedback to Keycloak Server guide docs
• #​27976 Persist online sessions to the database
• #​27997 Make the Language Selector sorted and searchable
• #​28009 Address edits to the Operator Guide
• #​28033 Upgrade Infinispan to 14.0.27.Final
• #​28035 update for messages_de.properties required translations
• #​28084 Upgrade to Quarkus 3.8.3 dist/quarkus
• #​28120 Default password hashing algorithm should be set to default password hash provider
• #​28142 Update HA Guide now that non-XA mode is the default
• #​28145 Align help output for Quarkus distribution across Windows and Linux dist/quarkus
• #​28161 Use Argon2 password hashing by default
• #​28178 Provide histograms for http server metrics
• #​28256 Prevent duplicate form submission in Create realm dialog in admin ui admin/ui
• #​28318 Use the same new code for persistent sessions for offline sessions core
• #​28336 Provide a dedicated way of updating Quarkus classloading indices
• #​28388 Handle concurrent writes to sessions more gracefullly
• #​28429 Add details to error messages, especially around refresh tokens
• #​28436 When LDAP groups synchronization fails, show root cause in admin UI admin/api
• #​28448 Avoid deprecated `jboss-modules` method usage
• #​28453 More conventional looking conditional element in authentication diagram admin/ui
• #​28460 Polishing docs for lightweight tokens oidc
• #​28477 The concurrency of hashing leads to increased memory usage and CPU throttling
• #​28501 Batch updates to the database to avoid using too many IOPS
• #​28517 Java 21 support
• #​28567 Change user_id value for REFRESH_TOKEN and REFRESH_TOKEN_ERROR events oidc
• #​28616 Add ui-tab context information into the onCreate
• #​28650 Improve german translations for admin ui
• #​28654 Refine the warning produced when a non-cli build-time property is used at runtime dist/quarkus
• #​28672 For client-credential-grants, there shouldn't be an interaction with the authentication cache
• #​28729 Emphasize the need for setting container limit docs
• #​28814 Add missing german translations for user federation in admin UI
• #​28848 Automatically fill username when authenticating to through a broker
• #​28861 Improve the performance of the PermissionTicketStore.findGrantedResources method authorization-services
• #​28862 Improve persistent sessions DB throughput for logins/logouts by batching
• #​28879 Indicate whether a user is transient or not in user sessions list
• #​28880 Upgrade to Quarkus 3.8.4 dist/quarkus
• #​28906 ID fields in SessionWrapper should be immutable
• #​28926 Store extended error message in events for client credential grants
• #​28935 Ensure GroupResource.getSubGroups doesn't rely on no-arg version of GroupModel.getSubGroupsStream to avoid prematurely loading all subgroups storage
• #​28939 OIDC: Backchannel logout token should use "typ":"logout+jwt" oidc
• #​28974 Replace tooltip for adding a translation to an attribute with a text underneath `Display name`
• #​29023 Support adding existing users to an organization
• #​29068 Infinispan 15.0.3.Final
• #​29073 Use cache.compute() method to improve the replace retry loop
• #​29118 Conditionally run Quarkus IT in GHA based on code changes testsuite
• #​29124 Use Java locale translations instead of manually edited translations translations
• #​29166 Improve details for user error events in OIDC protocol endpoints oidc
• #​29183 Minor corrections to High Availability Guide docs
• #​29203 Revisit SessionsResource#realmSessions as it current loads all sessions into memory
• #​29223 Complete transistion away from Resteasy core
• #​29280 Update Create Realm in Keycloak 24 Getting Started
• #​29319 Don't sort persistent sessions when retrieving a list
• #​29348 Set default role mapping filter in the role mapping modal
• #​29375 Allow migration of non-persistent sessions to persistent sessions
• #​29392 Avoid conflicts when writing make store keys
• #​29431 Make sure organization groups can not be managed but when managing an organization
• #​29460 Email validation for managed members should only fail if it does not match the domain set to a broker
• #​29489 Describe how to enable and disable persistent sessions for an installation docs
• #​29561 Revisit rolling configuration upgrades for persistent-sessions feature
• #​29639 Enhance documentation for REST API for X.509 Direct Grant Flow usage authentication
• #​29724 VC issuance in Authz Code flow without considering “scope” parameter
• #​29743 Infinispan 15.0.4.Final
• #​29750 Require external Infinispan be of version 15 or greater
• #​29778 Upgrade Selenium and Arquillian dependencies in testsuite testsuite
• #​29780 Unify approach for WebAuthn tests testsuite
• #​29787 Document Failover Lambda for Active/Passive deployments
• #​29794 Show a message when confirming an invitation link
• #​29813 Snyk report to identify branches impacted by a CVE ci
• #​29818 Avoid explicit flush when handling persistent sessions
• #​29880 Improve documentation for the case when 'basic' client scope already exists storage
• #​29883 Upgrade old Keycloak version for DB migration tests testsuite
• #​29919 Avoid IntelliJ to automatically create start imports
• #​30017 Improve Client Type Integration Tests oidc
• #​30026 Conditionally execute WebAuthn tests when Account console UI is changed testsuite
• Mend Renovate. View the repository job log.

[codeclimate]

Code Climate has analyzed commit bdf67a3 and detected 0 issues on this pull request.

View more on Code Climate.