https://cybertoolchain.io/tools/keycloak New releases and features in Keycloak, tracked by The Cyber Toolchain. en Mon, 05 Oct 2026 08:04:42 GMT https://www.keycloak.org/docs-api/latest/rest-api/openapi.json https://www.keycloak.org/docs-api/latest/rest-api/openapi.json Mon, 05 Oct 2026 08:04:42 GMT Breaking changes: • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs/latest/release_notes/index.html https://www.keycloak.org/docs/latest/release_notes/index.html Mon, 05 Oct 2026 07:56:19 GMT Keycloak: Adds a new client policy executor to restrict the `may_act` claim in access tokens, giving per-client control over which clients can participate in delegation. • Promotes Client Admin API v2 from experimental to preview, now enabled with `--features=client-admin-api:v2` or `--features=preview`, supporting declarative OIDC and SAML client management with strict validation and an accurate OpenAPI specification. Breaking changes: • Multi-cluster v1 (the `infinispan` feature) is deprecated and will be removed in a future major release; migrate to multi-cluster v2 using `--features=stateless`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs-api/latest/rest-api/openapi.json https://www.keycloak.org/docs-api/latest/rest-api/openapi.json Sun, 04 Oct 2026 13:53:32 GMT Breaking changes: • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs/latest/release_notes/index.html https://www.keycloak.org/docs/latest/release_notes/index.html Sun, 04 Oct 2026 07:49:45 GMT Keycloak 26.8.0 adds OID4VP credential verification, SCIM API support, multi-cluster stateless mode, token delegation with FGAP, and a wave of preview promotions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables OID4VCI with `--features=oid4vc-vci` or `--features=preview`; adds experimental `oid4vc-mdoc` format support, credential revocation on refresh token revocation, and an Application Initiated Action for in-session credential issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `oid4vc-vp` experimental feature for OID4VP verifier support, enabling cross-device wallet credential presentations with `direct_post.jwt` encrypted response mode and SD-JWT User Attribute and Session mappers. • Promotes multi-cluster v2 (`--features=stateless`) to supported, enabling multi-cluster deployments without an external Infinispan cluster by storing session data in the database. • Promotes SCIM API to supported, adding multivalued user attributes, User Profile permissions, Fine-Grained Admin Permissions in search filters, and improved performance for large user bases. • Auto-creates `delegation:user` and `delegation:client` client scopes as Optional scopes in all realms, with delegation authorization controlled via Fine-Grained Admin Permissions V2 `delegate` and `delegate-members` scopes. • Adds `secure-client-node-hostname` client policy executor to validate cluster node hostnames against admin-configured regex patterns on the `/clients-managements/register-node` endpoint, preventing SSRF. • Adds `allowed-protocol-mappers` executor to Client Policies to restrict protocol mapper types creatable via Admin REST API protocol mapper endpoints. • Adds `invite-user` workflow step that automatically sends an action-token email when a user is created, with configurable required actions, client, and redirect URI. • Enriches `CODE_TO_TOKEN`, `REFRESH_TOKEN`, and other token lifecycle events with `impersonator` and `impersonator_id` details, and includes a non-disableable `act` claim in access and ID tokens for impersonation sessions. • Promotes Client Secret Rotation to supported, allowing confidential clients to hold up to two concurrently active secrets for zero-downtime rotation via client policies. • Promotes Client Admin API v2 to preview, enabled with `--features=client-admin-api:v2` or `--features=preview`, with a Java client, auto-generated JavaScript client, CLI, and Operator `KeycloakClient` custom resources. • Promotes Parameterized scopes (formerly dynamic scopes) to preview, allowing clients to pass a parameter value with the scope name in OAuth 2.0 authorization requests. • Emits `account-disabled` and `account-enabled` RISC event types from the experimental Shared Signals Framework (SSF) when a user is enabled or disabled. • Adds support for encrypted PEM files for TLS certificate and private key configuration. • Stores login failures in the database instead of in-memory. • Adds first-class CLI options for cluster and node name. • Adds automatic non-blocking index creation for large database tables. • Adds experimental Vert.x-based outbound HTTP client. • Adds experimental Helm Chart Operator install support. • Adds shared identity providers across organizations. • Redesigns identity provider buttons on the login page. • Generated system truststore uses BCFKS format in strict FIPS mode. Breaking changes: • Multi-cluster v1 (the `multi-site` feature) is deprecated and will be removed in a future major release; migrate to multi-cluster v2 using `--features=stateless`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs-api/latest/rest-api/openapi.json https://www.keycloak.org/docs-api/latest/rest-api/openapi.json Sat, 03 Oct 2026 13:02:47 GMT API surface changed: +2 endpoints, 22 modified, 4 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint PUT /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint PUT /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/membership-type • GET /admin/realms/{realm}/organizations: param identityProvider (query) added • GET /admin/realms/{realm}/organizations/count: param identityProvider (query) added • GET /admin/realms/{realm}/organizations/{org-id}/groups/group-by-path/{path}: param briefRepresentation (query) added • POST /admin/realms/{realm}/organizations/{org-id}/members/invite-user: param client_id (query) added Breaking changes: • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download (still works) • Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/10/keycloak-2680-released https://www.keycloak.org/2026/10/keycloak-2680-released Thu, 01 Oct 2026 00:00:00 GMT Keycloak 26.8 adds supported SCIM API and multi-cluster stateless mode, OID4VCI/OID4VP credentials, and token exchange delegation for AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables `--features=stateless` to run multi-cluster v2 deployments without an external Infinispan cluster, storing session data in the database instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables `--features=preview` or `--features=oid4vc-vci` to activate OID4VCI verifiable credential issuance (promoted from experimental to preview), with credential revocation on refresh-token revocation and a new Application Initiated Action for in-session credential requests. • Adds experimental `oid4vc-mdoc` feature flag for mdoc credential format support. • Enables `--features=preview` or `--features=client-admin-api:v2` to activate the Client Admin API v2 (promoted to preview), providing strict validation, declarative configuration, and an accurate OpenAPI spec for OIDC and SAML clients. • Promotes the SCIM API to supported, adding multivalued user attributes, User Profile permissions, Fine-Grained Admin Permissions in search filters, and improved performance for large user bases. • Adds `delegation:client:<client-id>` parameterized scope for OAuth consent-based token exchange delegation, producing tokens with an `act` claim identifying the delegated client as the actor. • Auto-creates `delegation:user` and `delegation:client` client scopes as Optional scopes in all realms, with delegation authorization controlled through Fine-Grained Admin Permissions V2 using `delegate` and `delegate-members` scopes. • Adds `secure-client-node-hostname` client policy executor to validate cluster node registration hostnames against administrator-configured regex patterns, protecting against SSRF via the legacy adapter endpoint `/clients-managements/register-node`. • Adds `allowed-protocol-mappers` client policy executor to restrict which protocol mapper types can be created or updated through Admin REST API protocol mapper endpoints. • Adds `invite-user` workflow step that sends an action-token email automatically when a user is created, with configurable required actions and optional client and redirect URI. • Enriches token lifecycle events (`CODE_TO_TOKEN`, `REFRESH_TOKEN`, and others) with `impersonator` and `impersonator_id` details, and includes the `act` claim (RFC 8693 Section 4.1) in access tokens and ID tokens issued from impersonation sessions. • Adds OID4VP verifier support (experimental) enabling authentication flows where users present verifiable credentials from digital wallets, supporting cross-device presentation flows and `direct_post.jwt` encrypted response mode. • Adds SD-JWT User Attribute and Session mappers to extract claims from verifiable credentials presented via OID4VP. • Adds RISC `account-disabled` and `account-enabled` event types to the experimental Shared Signals Framework (SSF) support. • Promotes parameterized scopes (formerly dynamic scopes) from experimental to preview, allowing clients to pass a parameter value with the scope name (e.g. `project:12345`) in OAuth 2.0 authorization requests. • Promotes Client Secret Rotation from preview to supported, allowing confidential clients to keep up to two concurrently active secrets during rotation via client policies. • Adds a new client policy executor to restrict the `may_act` claim in access tokens, giving per-client control over which clients can participate in delegation. • Promotes `KeycloakOIDCClient` and `KeycloakSAMLClient` Operator custom resources to preview, enabling declarative client management via the Keycloak Operator. • Publishes a new deployment guide for multi-cluster v2 on bare-metal and VM environments alongside the existing Kubernetes guide. Breaking changes: • Multi-cluster v1 (the multi-site feature) is deprecated and will be removed in a future major release; the recommended replacement is multi-cluster v2 enabled with `--features=stateless`. • The Shared Signals Framework event structure has been revised for better alignment with CAEP and RISC specifications; existing consumers of SSF events should review the updated payload shapes. • The admin event store no longer receives unvalidated SSF payloads to prevent PII leakage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs-api/latest/rest-api/openapi.json https://www.keycloak.org/docs-api/latest/rest-api/openapi.json Thu, 20 Aug 2026 14:19:43 GMT API surface changed: 2 modified Breaking changes: • GET /admin/realms/{realm}/clients/{client-uuid}/roles/{role-name}/groups: param max (query) added; param 100 (query) removed • GET /admin/realms/{realm}/roles/{role-name}/groups: param max (query) added; param 100 (query) removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs-api/latest/rest-api/openapi.json https://www.keycloak.org/docs-api/latest/rest-api/openapi.json Tue, 04 Aug 2026 11:29:41 GMT API surface changed: 7 deprecated Breaking changes: • Deprecated endpoint GET /admin/realms/{realm}/authentication/executions/{executionId}/config/{id} (still works) • Deprecated endpoint GET /admin/realms/{realm}/client-scopes/{client-scope-id}/scope-mappings (still works) • Deprecated endpoint GET /admin/realms/{realm}/client-templates/{client-scope-id}/scope-mappings (still works) • Deprecated endpoint GET /admin/realms/{realm}/clients/{client-uuid}/scope-mappings (still works) • Deprecated endpoint POST /admin/realms/{realm}/authentication/config (still works) • Deprecated endpoint POST /admin/realms/{realm}/testSMTPConnection (still works) • Deprecated endpoint PUT /admin/realms/{realm}/users/{user-id}/reset-password-email (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/multi-cluster-v2-and-stateless-mode https://www.keycloak.org/2026/07/multi-cluster-v2-and-stateless-mode Fri, 17 Jul 2026 00:00:00 GMT Keycloak 26.7 adds stateless mode preview, moving auth sessions and brute-force counters to the DB to enable simpler multi-cluster deployments. • New `stateless` preview feature stores authentication sessions, action tokens, and brute-force counters in the database instead of distributed Infinispan caches. • Enables Multi-Cluster v2: two or more independent Keycloak clusters connected only through a synchronously replicated database, with no external Infinispan cluster required. • Cross-cluster cache invalidation now uses a database outbox/queuing table with a default polling interval of 100 ms, eliminating direct network connections between clusters. • Authentication sessions survive full cluster restarts during minor upgrades, keeping users mid-login from losing progress. • Multi-cluster failover is now environment-agnostic — not tied to Kubernetes or a specific cloud provider — using any synchronously replicated database (tested with Amazon Aurora PostgreSQL) and an external load balancer (tested with AWS Global Accelerator). • Removes dependency on external Infinispan cluster for multi-site setups, eliminating its monitoring and failover/failback operational overhead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/multi-cluster-v2-and-stateless-mode https://www.keycloak.org/2026/07/multi-cluster-v2-and-stateless-mode Fri, 17 Jul 2026 00:00:00 GMT Keycloak 26.7 adds stateless mode preview, moving auth sessions and brute-force counters to the DB to enable simpler multi-cluster deployments. • New `stateless` preview feature stores authentication sessions, action tokens, and brute-force counters in the database instead of distributed Infinispan caches. • Enables Multi-Cluster v2: two or more independent Keycloak clusters connected only through a synchronously replicated database, with no external Infinispan cluster required. • Cross-cluster cache invalidation now uses a database outbox/queuing table with a default polling interval of 100 ms, eliminating direct network connections between clusters. • Authentication sessions survive full cluster restarts during minor upgrades, keeping users mid-login from losing progress. • Multi-cluster failover is now environment-agnostic — not tied to Kubernetes or a specific cloud provider — using any synchronously replicated database (tested with Amazon Aurora PostgreSQL) and an external load balancer (tested with AWS Global Accelerator). • Removes dependency on external Infinispan cluster for multi-site setups, eliminating its monitoring and failover/failback operational overhead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/keycloak-2670-released https://www.keycloak.org/2026/07/keycloak-2670-released Thu, 09 Jul 2026 00:00:00 GMT Keycloak 26.7.0 adds SCIM API preview, SSF real-time signals, AuthZen PDP, SAML step-up auth, and a new Admin API v2. • Adds SCIM API (preview) for automating user and group provisioning and deprovisioning via standard CRUD, PATCH, filtering, pagination, and schema discovery endpoints. • Adds OpenID Shared Signals Framework (SSF) Transmitter support (experimental), pushing signed Security Event Tokens to relying parties via push (RFC 8935) and poll (RFC 8936) delivery with durable outbox and retry logic. • Adds AuthZen Evaluation API (experimental) implementing the OpenID AuthZEN Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions. • Promotes step-up authentication for SAML clients to supported status, enabling SAML service providers to request specific authentication context classes. • Adds Identity Brokering API v2 with client-level authorization, confidential-clients-only enforcement, OAuth 2.0-compliant POST endpoint, and a new session-based token storage option. • Adds Identity Assertion JWT Authorization Grant (ID-JAG) support (experimental), allowing Keycloak to accept cross-domain identity assertions and issue access tokens without re-authentication. • Adds token exchange delegation (experimental) with a new delegation parameterized scope type that validates impersonation rights before granting token exchange. • Introduces Admin API v2 (experimental) for declarative OIDC and SAML client management with strict validation, accurate OpenAPI spec, and Java/JavaScript/CLI clients. • Adds fine-grained delegation for organization administration, introducing dedicated admin roles and Fine-Grained Admin Permissions for organizations. • Adds OID4VCI credential refresh interval configuration via `vc.refresh_interval_in_seconds` in client scope settings, plus admin UI support for all OID4VCI settings and user-initiated credential issuance from the account console. • Adds MCP authorization documentation for Claude Code as a new MCP client integration alongside existing VS Code support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/keycloak-2670-released https://www.keycloak.org/2026/07/keycloak-2670-released Thu, 09 Jul 2026 00:00:00 GMT Keycloak 26.7.0 adds SCIM API preview, SSF real-time signals, AuthZen PDP, SAML step-up auth, and a new Admin API v2. • Adds SCIM API (preview) for automating user and group provisioning and deprovisioning via standard CRUD, PATCH, filtering, pagination, and schema discovery endpoints. • Adds OpenID Shared Signals Framework (SSF) Transmitter support (experimental), pushing signed Security Event Tokens to relying parties via push (RFC 8935) and poll (RFC 8936) delivery with durable outbox and retry logic. • Adds AuthZen Evaluation API (experimental) implementing the OpenID AuthZEN Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions. • Promotes step-up authentication for SAML clients to supported status, enabling SAML service providers to request specific authentication context classes. • Adds Identity Brokering API v2 with client-level authorization, confidential-clients-only enforcement, OAuth 2.0-compliant POST endpoint, and a new session-based token storage option. • Adds Identity Assertion JWT Authorization Grant (ID-JAG) support (experimental), allowing Keycloak to accept cross-domain identity assertions and issue access tokens without re-authentication. • Adds token exchange delegation (experimental) with a new delegation parameterized scope type that validates impersonation rights before granting token exchange. • Introduces Admin API v2 (experimental) for declarative OIDC and SAML client management with strict validation, accurate OpenAPI spec, and Java/JavaScript/CLI clients. • Adds fine-grained delegation for organization administration, introducing dedicated admin roles and Fine-Grained Admin Permissions for organizations. • Adds OID4VCI credential refresh interval configuration via `vc.refresh_interval_in_seconds` in client scope settings, plus admin UI support for all OID4VCI settings and user-initiated credential issuance from the account console. • Adds MCP authorization documentation for Claude Code as a new MCP client integration alongside existing VS Code support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/keycloak-2670-released https://www.keycloak.org/2026/07/keycloak-2670-released Thu, 09 Jul 2026 00:00:00 GMT Keycloak 26.7.0 adds SCIM API preview, SSF real-time signals, AuthZen PDP, SAML step-up auth, and a new Admin API v2. • Adds SCIM API (preview) for automating user and group provisioning and deprovisioning via standard CRUD, PATCH, filtering, pagination, and schema discovery endpoints. • Adds OpenID Shared Signals Framework (SSF) Transmitter support (experimental), pushing signed Security Event Tokens to relying parties via push (RFC 8935) and poll (RFC 8936) delivery with durable outbox and retry logic. • Adds AuthZen Evaluation API (experimental) implementing the OpenID AuthZEN Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions. • Promotes step-up authentication for SAML clients to supported status, enabling SAML service providers to request specific authentication context classes. • Adds Identity Brokering API v2 with client-level authorization, confidential-clients-only enforcement, OAuth 2.0-compliant POST endpoint, and a new session-based token storage option. • Adds Identity Assertion JWT Authorization Grant (ID-JAG) support (experimental), allowing Keycloak to accept cross-domain identity assertions and issue access tokens without re-authentication. • Adds token exchange delegation (experimental) with a new delegation parameterized scope type that validates impersonation rights before granting token exchange. • Introduces Admin API v2 (experimental) for declarative OIDC and SAML client management with strict validation, accurate OpenAPI spec, and Java/JavaScript/CLI clients. • Adds fine-grained delegation for organization administration, introducing dedicated admin roles and Fine-Grained Admin Permissions for organizations. • Adds OID4VCI credential refresh interval configuration via `vc.refresh_interval_in_seconds` in client scope settings, plus admin UI support for all OID4VCI settings and user-initiated credential issuance from the account console. • Adds MCP authorization documentation for Claude Code as a new MCP client integration alongside existing VS Code support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/experimental-ssf-support https://www.keycloak.org/2026/07/experimental-ssf-support Fri, 03 Jul 2026 00:00:00 GMT Keycloak gains experimental OpenID Shared Signals Framework (SSF) 1.0 Transmitter support, pushing signed SETs to receivers in seconds. • Adds experimental SSF 1.0 Transmitter role: Keycloak now pushes signed Security Event Tokens (SETs) to subscribed receivers for identity events such as session revocation, credential change, and account disable. • Supports CAEP 1.0 and RISC 1.0 event profiles, automatically mapping native Keycloak events (login, logout, credential change, session revocation) to the correct standardised event types. • Supports both HTTP push (RFC 8935) and HTTP poll (RFC 8936, return-immediately) delivery channels for SET distribution. • Introduces a transactional outbox: events are durably persisted in the same transaction that produced them, then drained asynchronously with exponential backoff, decoupling generation from delivery. • New synthetic event REST endpoint lets external tools (e.g. SOC/IAM platforms) inject events that did not originate inside Keycloak — useful for bridging external credential-change signals. • Configures SSF Receivers as standard OIDC clients with a per-client `ssf.enabled` toggle, `ssf.read`/`ssf.manage` scopes, and a `defaultSubjects` policy of `ALL` or `NONE`. • Adds per-receiver event filter (`emit-only-events` allowlist) so each receiver subscribes only to the event types it needs. • Ships legacy SSE CAEP draft profile for Apple Business Manager and Apple School Manager interoperability, enabling Keycloak to act as a federated IdP for Apple device fleets. • Exposes full stream CRUD plus status, verification, and stream-config endpoints; streams and subjects are manageable via both the Admin REST API and new Admin Console SSF tabs. • Adds Prometheus metrics under the `keycloak_ssf_*` namespace covering dispatcher, drainer, poll endpoints, verification flow, outbox depth, and per-delivery counters and latencies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/experimental-ssf-support https://www.keycloak.org/2026/07/experimental-ssf-support Fri, 03 Jul 2026 00:00:00 GMT Keycloak gains experimental OpenID Shared Signals Framework (SSF) 1.0 Transmitter support, pushing signed SETs to receivers in seconds. • Adds experimental SSF 1.0 Transmitter role: Keycloak now pushes signed Security Event Tokens (SETs) to subscribed receivers for identity events such as session revocation, credential change, and account disable. • Supports CAEP 1.0 and RISC 1.0 event profiles, automatically mapping native Keycloak events (login, logout, credential change, session revocation) to the correct standardised event types. • Supports both HTTP push (RFC 8935) and HTTP poll (RFC 8936, return-immediately) delivery channels for SET distribution. • Introduces a transactional outbox: events are durably persisted in the same transaction that produced them, then drained asynchronously with exponential backoff, decoupling generation from delivery. • New synthetic event REST endpoint lets external tools (e.g. SOC/IAM platforms) inject events that did not originate inside Keycloak — useful for bridging external credential-change signals. • Configures SSF Receivers as standard OIDC clients with a per-client `ssf.enabled` toggle, `ssf.read`/`ssf.manage` scopes, and a `defaultSubjects` policy of `ALL` or `NONE`. • Adds per-receiver event filter (`emit-only-events` allowlist) so each receiver subscribes only to the event types it needs. • Ships legacy SSE CAEP draft profile for Apple Business Manager and Apple School Manager interoperability, enabling Keycloak to act as a federated IdP for Apple device fleets. • Exposes full stream CRUD plus status, verification, and stream-config endpoints; streams and subjects are manageable via both the Admin REST API and new Admin Console SSF tabs. • Adds Prometheus metrics under the `keycloak_ssf_*` namespace covering dispatcher, drainer, poll endpoints, verification flow, outbox depth, and per-delivery counters and latencies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/07/experimental-ssf-support https://www.keycloak.org/2026/07/experimental-ssf-support Fri, 03 Jul 2026 00:00:00 GMT Keycloak gains experimental OpenID Shared Signals Framework (SSF) 1.0 Transmitter support, pushing signed SETs to receivers in seconds. • Adds experimental SSF 1.0 Transmitter role: Keycloak now pushes signed Security Event Tokens (SETs) to subscribed receivers for identity events such as session revocation, credential change, and account disable. • Supports CAEP 1.0 and RISC 1.0 event profiles, automatically mapping native Keycloak events (login, logout, credential change, session revocation) to the correct standardised event types. • Supports both HTTP push (RFC 8935) and HTTP poll (RFC 8936, return-immediately) delivery channels for SET distribution. • Introduces a transactional outbox: events are durably persisted in the same transaction that produced them, then drained asynchronously with exponential backoff, decoupling generation from delivery. • New synthetic event REST endpoint lets external tools (e.g. SOC/IAM platforms) inject events that did not originate inside Keycloak — useful for bridging external credential-change signals. • Configures SSF Receivers as standard OIDC clients with a per-client `ssf.enabled` toggle, `ssf.read`/`ssf.manage` scopes, and a `defaultSubjects` policy of `ALL` or `NONE`. • Adds per-receiver event filter (`emit-only-events` allowlist) so each receiver subscribes only to the event types it needs. • Ships legacy SSE CAEP draft profile for Apple Business Manager and Apple School Manager interoperability, enabling Keycloak to act as a federated IdP for Apple device fleets. • Exposes full stream CRUD plus status, verification, and stream-config endpoints; streams and subjects are manageable via both the Admin REST API and new Admin Console SSF tabs. • Adds Prometheus metrics under the `keycloak_ssf_*` namespace covering dispatcher, drainer, poll endpoints, verification flow, outbox depth, and per-delivery counters and latencies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/2026/06/keycloak-2663-released https://www.keycloak.org/2026/06/keycloak-2663-released Thu, 04 Jun 2026 00:00:00 GMT Keycloak 26.6.3 adds DB startup checks, FD_SOCK2 SPI, and SQL Server collation fix. • Adds `startup check for missing database indexes` to detect schema drift before boot • Adds SPI option to disable `FD_SOCK2` failure detection for advanced cluster tuning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-26-6-0 https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-26-6-0 Tue, 25 Nov 2025 00:00:00 GMT Keycloak 26.6.0 adds Workflows (YAML automation), JWT Auth Grant, Federated Client Auth, Org Groups, Vault SPI secrets lookup, and zero-downtime defaults. • Adds `workflows` subsystem allowing administrators to automate realm tasks using YAML-defined logic triggered by events, conditions, or schedules • Promotes JWT Authorization Grant (RFC 7523) to supported status, enabling external-to-internal token exchange via externally signed JWT assertions • Promotes Federated client authentication to supported status for clients leveraging existing credentials from trusted issuers, including Kubernetes Service Accounts and OIDC providers • Adds `Organization groups` feature supporting isolated group hierarchies per organization with Identity Provider mappers for automated assignment based on external claims • Adds new FGAP scope `manage-membership-of-members` to enable user-side bridge evaluation for group membership permissions based on current user memberships • Enables secrets lookup for clients via the Vault SPI, allowing management and retrieval of client secrets through the standard SPI interface • Adds optional `Enable LDAP password policy` setting in LDAP advanced settings to prompt LDAP users to update passwords when the backend indicates a mandatory change • Promotes Zero-downtime patch releases to supported status and enables them by default for rolling updates within the same major.minor release stream • Adds new CLI options for database configuration including TLS setup, connection timeouts, transaction timeouts with production defaults, and UTF-8 encoding verification at startup • Enables graceful shutdown of the HTTP stack to prevent error responses during rolling updates or configuration changes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-26-4-0 https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-26-4-0 Wed, 18 Jun 2025 00:00:00 GMT Keycloak 26.4.0 adds Passkeys, DPoP support, FAPI 2 compliance, Federated Client Auth preview, and automated SAML cert management. • Adds `fapi-2-dpop-security-profile` and `fapi-2-dpop-message-signing` client profiles for FAPI 2 compliance • Enables Passkeys authentication via the `Authentication > Policies > Webauthn Passwordless Policy` UI toggle • Adds support for OAuth 2.0 DPoP tokens on Admin REST API and Account REST API endpoints • Allows public clients to bind only refresh tokens to DPoP, omitting access token binding • Supports requiring the `dpop_jkt` parameter in OIDC authentication requests • Adds Federated Client Authentication preview for SPIFFE JWT SVIDs and Kubernetes service account tokens • Automates SAML client certificate rotation via the `Metadata descriptor URL` setting in `Signature and Encryption` section • Exposes OAuth 2.0 Authorization Server Metadata via well-known URI compliant with RFC 8414 for MCP integration Breaking changes: • None explicitly documented as breaking; multi-site terminology updated to multi-cluster Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-17-0-0 https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-17-0-0 Wed, 01 Jun 2022 00:00:00 GMT Keycloak 17.0.0 introduces Quarkus distribution, `JAVA_OPTS_APPEND`, glob-like user search, and lazy offline sessions. • Adds `JAVA_OPTS_APPEND` environment variable to pass custom Java options in the new Quarkus distribution • Supports glob-like syntax (prefix, infix, exact) for User Search in the Admin Console • Loads offline sessions lazily by default instead of preloading at startup Breaking changes: • `h2-mem` and `h2-file` database types are renamed to `dev-mem` and `dev-file` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/keycloak