Pull Request Explorer

Summary

WebAuthn authenticator attachment policy bypass fix

Fixes a security flaw where the WebAuthn authenticator attachment policy could be bypassed if the client omitted the attachment field, strengthening authentication security.

Health Assessment

• • Fast review and merge within 3 days, minimal code changes, low risk.

Summary

WebAuthn authenticator attachment policy bypass fix

Fixes a security issue where WebAuthn authenticator attachment policy could be bypassed if the client omitted the attachment field, ensuring proper enforcement of policy and improving authentication security.

Health Assessment

• • Fast review and minimal changes indicate a straightforward bug fix with low risk.

Summary

Run deprecation checks only on main branch

Ensures deprecation checks are executed only on the main branch, reducing unnecessary checks on feature branches.

Health Assessment

• • The PR had a moderate review time but minimal changes, indicating a straightforward update to CI behavior.

Summary

Fix clustering test timeouts

Resolves clustering test failures due to database reuse and load‑balancer startup races, improving test reliability and production readiness.

Health Assessment

• • Quick resolution with minimal rework; single review and small changes indicate low complexity.

Summary

Improve JFR scrub section in the Observability guide

Enhances guidance for safely sharing Keycloak recordings by expanding risk tables and adding exclusions, improving security compliance.

Health Assessment

• • Fast review cycle with AI assistance, minimal changes, low risk.

Summary

Fix clustering test timeouts

Resolves test failures due to database reuse and load‑balancer startup races, improving CI reliability.

Health Assessment

• • Merged quickly after a single AI‑assisted review, minimal code changes, low risk.

Summary

Add JFR section to Observability guide

Provides detailed guidance on capturing, sanitizing, and securing Java Flight Recorder recordings, enhancing troubleshooting capabilities for Keycloak users.

Health Assessment

• • The PR required over nine days to merge, with multiple review rounds and copilot-generated comments, indicating significant rework on documentation.

Summary

Tolerate a null username and stop broker mappers from blanking it

Fixes login failures for users with null usernames after upgrade, improving reliability and preventing data loss.

Health Assessment

• • The PR took over 10 days to merge, largely due to a delayed review cycle, but required no additional commits after the initial change, indicating a straightforward fix. The use of Copilot for review helped surface issues early.

Summary

Add OID4VP verifier implementation

Adds an initial OpenID4VP wallet login verifier to Keycloak, enabling support for OID4VP identity providers and a test harness for conformance modules.

Health Assessment

• • The PR underwent extensive review with Copilot-generated comments and multiple review rounds, indicating a complex implementation and higher risk of integration issues.

Summary

Fix WebAuthn authenticator attachment policy bypass

Removes a security vulnerability that allowed bypassing the authenticator attachment policy during WebAuthn registration, ensuring compliance with browser standards and strengthening authentication security.

Health Assessment

• • Quick resolution with minimal changes and fast review, indicating low complexity and high confidence in the fix.

Summary

Review and adjust test tagging for Core IAM

Ensures only relevant integration tests run in the Core IAM database matrix, improving test suite efficiency and reliability.

Health Assessment

• • The PR involved extensive test maintenance across many files, with AI‑assisted review and multiple iterations, leading to a slow cycle time but ultimately improving test matrix efficiency.

Summary

Run deprecation checks only on main branch

Ensures deprecation checks are executed only in the main branch, reducing unnecessary test runs and speeding up CI pipelines.

Health Assessment

• • Quick approval with minimal changes indicates low complexity and high confidence in the change.

Summary

Decouple ListOptions from Client fields

Refactors the admin API sorting logic to be resource‑agnostic, improving maintainability and future extensibility.

Health Assessment

• • The PR received a quick initial review, but required two additional commits to address rebase and caching changes, indicating moderate iteration. AI‑assisted review helped surface issues early.

Summary

Defer LDAP group mapping calls

Fixes a race condition in LDAP group mapping by deferring group join, role grant, and required action calls until after LDAP entry creation, improving reliability for LDAP users.

Health Assessment

• • PR was merged within 11 hours with minimal rework; a flaky test was flagged but did not delay the merge.

Summary

Defer LDAP group and role calls to entry creation callback

This change defers certain LDAP operations to the entry creation callback, improving performance and reducing race conditions during user provisioning.

Health Assessment

• • Quick turnaround with a single commit and approval indicates a smooth review process.

Summary

Only run testsuite deprecation checks in main branch

Restricts deprecation checks to main branch, reducing unnecessary runs for non‑main PRs.

Health Assessment

• • Fast review and merge with minimal changes to CI script, indicating low risk and high confidence.

Summary

Fix release notes preview for Stateless 26.7

Updates release notes to correctly display preview for Stateless 26.7, improving documentation accuracy.

Health Assessment

• • Documentation change merged quickly with minimal review, indicating low complexity and risk.

Summary

Stateless: fix release notes to be preview

Corrects release notes for version 26.7 to accurately reflect stateless preview, ensuring users receive precise information.

Health Assessment

• • Quick review and merge with minimal changes indicate low complexity and high confidence in documentation accuracy.

Summary

Ensure admin role checks use actual granted roles

This PR fixes a security vulnerability by ensuring that admin API authorization checks rely on the roles actually granted to a user, preventing unauthorized access.

Health Assessment

• • Security fix with minimal review, but long cycle time due to scheduling and backlog.

Summary

Mitigate unauthenticated username enumeration

Prevents attackers from enumerating usernames via OAuth scopes, strengthening security for all clients.

Health Assessment

• • PR required multiple review rounds, including AI review and a human changes‑requested comment, but was merged within 49.5 hours, indicating moderate friction but acceptable cycle time for a security fix.

Summary

Add javadoc and source jars to release

Enables developers to access source and documentation artifacts, improving transparency and ease of integration.

Health Assessment

• • Quick review and merge, minimal changes, low risk.

Summary

Limit parameter length for client scopes

Adds a maximum length guardrail for parameterized client-scope parameters to prevent database constraint failures and mitigate unbounded attacker input.

Health Assessment

• • AI-assisted review enabled rapid approval; minimal changes; quick turnaround.

Summary

Add test for username sub-claim in may_act

Adds an integration test to validate that the may_act claim includes a preferred_username sub-claim, ensuring correct token mapping. This improves reliability of delegated token exchanges.

Health Assessment

• • Quick review and approval with minimal rework; test addition validates token mapping scenario.

Summary

Improve scope resolution to prevent accidental bypass

Enhances security by ensuring the most specific client scope is applied, preventing shorter scopes from overriding stricter ones.

Health Assessment

• • Quick review cycle with minimal rework; the change was straightforward and well-documented.

Summary

Improve Admin UI visual distinction for parameterized scope settings

Enhances the Keycloak admin UI by adding visual separation for parameterized scope settings, improving clarity and user experience for administrators.

Health Assessment

• • Fast review cycle with AI‑assisted review comment, minimal code changes, low risk.

Summary

Mention use of email address for username and delegation types in docs

Clarifies that email-based login also supports email addresses as usernames and delegation types, reducing confusion for administrators.

Health Assessment

• • Minimal changes (2 lines) and a single commit led to a quick review cycle; AI bot provided an initial review comment, but final approvals were straightforward.

Summary

Defer LDAP joinGroup calls during user creation

This change delays LDAP group joins until the LDAP entry is fully created, preventing null pointer exceptions and improving reliability during user registration.

Health Assessment

• • Fast review and merge with minimal rework; AI-assisted review helped identify edge‑case issues early.

Summary

Add javadoc and source jars to release

Adds Java source and Javadoc artifacts to the release, improving developer experience and documentation availability.

Health Assessment

• • Merged within minutes with a single review comment, indicating a straightforward build configuration change.

Summary

Fix incorrect permission name in Server Admin doc

Corrects an example permission name in the Server Admin documentation, ensuring the documentation accurately reflects the permission label.

Health Assessment

• • Quick review and merge within 4 hours, minimal changes, low risk.

Summary

Update Central Publishing Plugin to 0.11.0

The update brings the Sonatype Central Publishing Maven plugin to version 0.11.0, keeping Keycloak’s publishing tooling current. This ensures compatibility with the latest Maven release and reduces potential build issues.

Health Assessment

• • Quick review and merge within 7 hours, minimal changes, low risk.

Summary

Add time-based sorting to Admin API

Enables sorting of client list results by created/updated timestamps, improving admin usability.

Health Assessment

• • The PR received a quick initial review, a brief change request, and was merged after a few days, indicating a smooth and low-risk process.

Summary

Javadoc of keycloak-admin-client for Keycloak server 26.7 release

Adds Javadoc updates to the Keycloak Admin Client to reflect server 26.7 changes, improving developer clarity and reducing integration errors.

Health Assessment

• • Rapid review and merge indicate low complexity and high confidence in documentation changes.

Summary

Expand Operator guide security warning to all CRs

Enhances operator documentation to clarify security implications for all custom resources, improving user understanding and reducing misconfigurations.

Health Assessment

• • Quick review and minimal changes led to a fast merge; AI assistance streamlined documentation updates.

Summary

Add ID-JAG acronym to guide summary to improve searchability

Adds the ID-JAG acronym to the Identity Assertion JWT Authorization Grant guide summary, enhancing discoverability for users searching documentation.

Health Assessment

• • Fast review and merge with minimal changes, indicating low complexity and risk.

Summary

Improve Admin v2 list sorting performance

Caches parsing of sort query parameter to enum, reducing repeated parsing and improving response times for admin API calls.

Health Assessment

• • PR received immediate review, minimal rework, and was merged after ~5 days, indicating a straightforward performance fix with low risk.

Summary

Update admin client to 26.6 release

Ensures compatibility with the 26.6 admin client, preventing potential issues when core classes change.

Health Assessment

• • Quick fix with minimal changes, merged within 2.2 hours, indicating low complexity and high confidence.

Summary

Add context to deprecated default feature warnings

Enhances deprecation warnings to differentiate between explicitly enabled and default-enabled features, improving admin guidance.

Health Assessment

• • Fast review and single commit indicate a straightforward, low‑risk change with minimal friction.

Summary

Improve passkeys enablement UX in admin console

Admin console now displays a passkeys enablement toggle in Realm Settings → Login, making it easier for administrators to enable passkeys. Additional navigation shortcuts streamline access to policy settings, reducing configuration friction.

Health Assessment

• • The PR had a quick initial review but required two follow‑up commits to address reviewer feedback, resulting in a 4‑day cycle time. The changes are moderate in scope and focused on UI improvements, with minimal risk to core functionality.

Summary

Add credential refresh interval for OID4VCI

Introduces a vc.refresh_interval_in_seconds setting (default 7 days) that lets issuers control credential expiration independently from the underlying credential lifetime, enabling more efficient periodic refreshes.

Health Assessment

• • The PR had a long cycle time (~8 days) but a rapid first review; Copilot generated multiple comments that were addressed in a single follow‑up commit, indicating moderate review friction and a high risk due to the large code change and extended timeline.

Summary

Exclude synced-common dependency and add enforcement

Fixes a classpath conflict in the Operator caused by the admin client pulling in an older Keycloak representation.

Health Assessment

• • The PR has a moderate review friction due to the temporary workaround nature of the fix. The scope is small, but the risk level is medium due to potential dependencies on older common/core classes.

Summary

Add OIDC mapper for may_act claim

Enables RFC 8693 token‑exchange delegation by emitting the may_act claim, improving fine‑grained authorization for delegated actors.

Health Assessment

• • The PR had moderate review friction with AI‑assisted comments and a single changes‑requested round, but final approval was quick; the large code addition and extensive tests indicate a significant new feature addition.

Summary

Update OpenAPI filter to specific path

Restricts the enhanced sort parameter description to specific endpoints, improving API clarity and preventing unintended exposure.

Health Assessment

• • Fast review and single commit led to a quick resolution of a targeted bugfix.

Summary

Use custom implementation instead of uuid for web-crypto-shim

Replaces uuid dependency in web-crypto-shim with a custom implementation to avoid Web Crypto API reliance in insecure contexts, ensuring compatibility during development.

Health Assessment

• • Quick review with no rework; PR merged within 19 hours.

Summary

Fix error message in identity broker v2

Removes internal exception details from the Identity Broker v2 token endpoint, preventing potential information disclosure and improving security posture.

Health Assessment

• • Single commit with a quick review cycle, but overall cycle time was extended likely due to scheduling or other non-technical delays.

Summary

Add reverse proxy docs to isolate master realm

Adds guidance to prevent exposing the master realm to the public internet, improving security and compliance.

Health Assessment

• • Docs update with minimal changes, quick review, AI-assisted commit, low risk.

Summary

Add Traefik client certificate docs

Provides guidance for configuring client certificates with Traefik in Keycloak, filling a documentation gap.

Health Assessment

• • Fast review and merge, minimal changes, straightforward documentation update.

Summary

Rename and make cacheless feature Preview

Updates high‑availability documentation to reflect the feature’s preview status, removing the experimental banner and clarifying cacheless behavior.

Health Assessment

• • Fast 4.8‑hour cycle with AI‑assisted review and minimal code changes led to a smooth, low‑risk merge.

Summary

Harden removeRootAuthenticationSession realm ID check

Adds a security check to ensure only sessions belonging to the correct realm are removed, reducing risk of unauthorized session deletion.

Health Assessment

• • Fast review and merge with minimal changes, indicating low complexity and risk.

Summary

Rename cacheless feature to stateless

Renames the Keycloak feature previously known as cacheless to stateless and reclassifies it as a Preview feature.

Health Assessment

• • Fast review and merge process, with minimal comments and no major issues raised.

Summary

Adding release highlights for 26.7

Adds missing release highlights for Keycloak 26.7 and improves wording/formatting in the related upgrading guide entry, ensuring the release notes and upgrade documentation are accurate.

Health Assessment

• • Quick turnaround with minimal changes; review was automated by Copilot, resulting in a fast merge.