Pull Request Explorer

Summary

Fix HTTP 500 on multi-org consent screen

Resolves server error when users belong to multiple organizations, improving login reliability.

Health Assessment

• • Quick fix with minimal changes and immediate approval.

Summary

Implement tombstone marker for session deletion

Adds a short‑lived tombstone marker to prevent deleted user sessions from reappearing in the cache, ensuring reliable logout and session revocation.

Health Assessment

• • The PR fixed a critical concurrency bug with extensive review and multiple iterations, resulting in a large code change but a relatively quick merge.

Summary

Fix legacy lastSync fallback in UserStorageProvider

Ensures upgraded Keycloak installations resume incremental syncs without full scans, reducing memory usage and preventing OOM errors.

Health Assessment

• • AI-assisted review accelerated approval, but the PR’s long cycle time suggests scheduling or other non-technical delays.

Summary

Invalidate cache entries for getUserByFederatedIdentity when removing brokers

Fixes stale cache entries across nodes after broker removal, ensuring accurate user data and system reliability.

Health Assessment

• • Fast cycle time of 36.6 hours with minimal rework; AI‑assisted review helped maintain low friction.

Summary

Update @microsoft/kiota-http-fetchlibrary to v109

Fixes bug #52564 by updating the Kiota HTTP fetch library dependency to version 109, ensuring compatibility and stability.

Health Assessment

• • Quick dependency bump resolved a bug with minimal changes and fast review turnaround.

Summary

EOL Keycloak Realm Operator

Adds end‑of‑life notice for the Keycloak Realm Operator in the 26.8.0 upgrade guide, ensuring users are aware of deprecation.

Health Assessment

• • Rapid review and merge with minimal changes indicates low complexity and risk.

Summary

Fix quick theme login resource URLs for relative paths

Ensures quick theme preview and download work correctly on deployments with non-root http-relative-path, improving admin UI reliability. This fixes styling and download errors for admins using custom base paths.

Health Assessment

• • PR received an immediate review but had a long cycle time, likely due to scheduling. The change is minimal and resolves a specific UI bug.

Summary

Fix nightly scheduled runs

Fixes a bug in the nightly scheduled runs by removing an unnecessary dispatch job, ensuring the workflow runs correctly.

Health Assessment

• • Quick fix with minimal changes, AI review confirmed no issues, merged immediately.

Summary

Add session bucket and timestamp to auth session

Enhances session cleanup and expiration handling, improving performance and reliability.

Health Assessment

• • The PR underwent a lengthy review cycle with multiple AI‑assisted comments before approval, indicating careful scrutiny of the new session cleanup logic.
• • Despite a slow overall cycle time, the first review was rapid, suggesting initial confidence in the changes.

Summary

Update downstream guide with MCv2 changes

Documentation updated to reflect new multi‑cluster v2 guidance, improving clarity for deployment teams.

Health Assessment

• • Quick review and merge after BU feedback, minimal changes, low risk.

Summary

Revert enabling HTTP optimized serializers by default

Reverts a recent change that enabled HTTP optimized serializers by default, restoring previous behavior to avoid potential issues.

Health Assessment

• • Reverted a recent feature to maintain stability; AI-assisted review provided quick feedback; minimal changes and quick approval.

Summary

Fix SSF discovery document realm path omission

Corrects SSF issuer URL construction to include realm path, ensuring proper discovery document behavior and preventing authentication failures.

Health Assessment

• • The PR was reviewed immediately with AI assistance, requiring only minor adjustments and a single approval, indicating a smooth process.

Summary

Fix realm deletion using realm name

Ensures realm deletion uses the realm’s internal name, preventing 404 errors when display names differ and improving admin UI reliability.

Health Assessment

• • PR was reviewed immediately but had a long cycle time due to scheduling; the change is small and single‑commit, indicating low risk and minimal impact on the codebase.

Summary

Remove stripping of signing certificate

Fixes certificate handling by preserving signingCertificate, improving security and compatibility.

Health Assessment

• • Quick fix with minimal changes, approved after brief review.

Summary

Refresh tokens expire based on idle session time

Ensures refresh tokens respect idle session timeout, improving security and session management.

Health Assessment

• • The PR was reviewed by Copilot, resulting in multiple iterations over a 4‑day cycle, indicating moderate review friction for a medium‑sized backend change.

Summary

Fix MayAct executor delegation scope mismatch

Ensures delegation requests with non‑exact username scopes are correctly rejected, improving security and consistency.

Health Assessment

• • Quick resolution with minimal rework; AI review helped catch documentation inconsistencies.

Summary

Document SCIM and Admin API v2 null semantics

Clarifies how SCIM and Admin API v2 handle SQL null values in queries, improving developer understanding and preventing misinterpretation.

Health Assessment

• • Documentation update with quick review; long cycle time due to merge scheduling rather than technical complexity.

Summary

Deprecate client switch for refresh token usage

This PR removes the legacy client switch that allowed using refresh tokens for client credentials grant, improving security and aligning with updated protocol standards.

Health Assessment

• • The PR had a long cycle time with multiple review rounds, but the scope was small and the changes were straightforward, resulting in low risk.

Summary

Fix server cert leaf verification

Ensures TLS security by verifying the server certificate is a leaf and only disables hostname verification when the service name is invalid, preventing potential security regressions.

Health Assessment

• • Security regression fixed after multiple AI-assisted review iterations; review process was quick but involved several rounds of comments, indicating moderate review friction.

Summary

Fix organization mapper security vulnerability

Removes ability for attackers to select non-member organizations via OIDC mapper, strengthening security.

Health Assessment

• • Quick resolution with minimal changes and immediate approval indicates low friction and high confidence in the fix.

Summary

Fix prompt=none login_required with autoRedirect

Resolves a regression where authentication fails when organization domain has autoRedirect enabled, ensuring users can log in without interruption.

Health Assessment

• • Quick fix with minimal code changes, immediate review and approval, indicating low complexity and low risk to production.

Summary

Fix race condition in IdP mapper E2E helper

Ensures IdP mapper creation completes before navigation, preventing intermittent failures and improving test reliability.

Health Assessment

• • Quick fix with minimal changes, resolved race condition in E2E tests.

Summary

Fix AdminRoot authentication reuse

Ensures admin API v2 client requests succeed by caching and reusing AdminRoot authentication, improving reliability and security for administrative operations.

Health Assessment

• • The PR was reviewed and approved quickly by AI, with minimal human intervention, indicating efficient but AI‑driven review. The moderate scope and long cycle time suggest a typical bugfix with some complexity.

Summary

Deprecate client registration providers

This PR marks certain client registration providers as deprecated, updating documentation and code to guide users toward newer alternatives and maintain future compatibility.

Health Assessment

• • Fast review cycle with AI‑assisted review, minimal rework, clear deprecation path.

Summary

Fix role namespace confusion in OID4VCI credential offer authorization

This fix prevents unauthorized cross-user credential offer creation by ensuring realm role checks are identity-based, eliminating client role name collisions.

Health Assessment

• • Fast review and merge within 12 hours, minimal rework, indicating an efficient process.

Summary

Migrate AcrAuthFlowTest to new test framework

Updates the OIDC AcrAuthFlow test to use the new testing framework, ensuring compatibility and maintaining test behavior.

Health Assessment

• • The PR took over 4 days to merge, with a single AI‑assisted review and no subsequent changes, indicating a straightforward test migration with minimal friction.

Summary

Bump the actions-dependencies group across 1 directory with 4 updates

Updates GitHub Actions dependencies to newer versions, ensuring CI workflows use the latest security patches and features.

Health Assessment

• • Quick dependency update with immediate approval, minimal review friction.

Summary

Update jackson-databind dependency to 2.22.2

Ensures compatibility and security by updating the Jackson databind library to the latest patch version.

Health Assessment

• • Fast turnaround with minimal changes; no blockers.

Summary

MCP Documentation for 26.8

Adds updated guidance for MCP authentication and authorization in Keycloak 26.8, improving developer onboarding and reducing support tickets.

Health Assessment

• • Fast review and minimal changes indicate a straightforward documentation update with low risk.

Summary

Ensure denies apply only to same resource type policies

Fixes an authorization bug so that deny rules affect only policies on the same resource type, tightening security and preventing unintended access.

Health Assessment

• • The PR was reviewed immediately by Copilot with no human comments, indicating fast automated review but also a potential risk of insufficient human oversight.

Summary

Treat malformed username domain as no matching organization

Fixes authentication flow by treating malformed username domains as no matching organization, preventing generic error pages and ensuring users can proceed to password step.

Health Assessment

• • Quick review and merge within 5 days, minimal rework, AI-assisted code generation streamlined the process.

Summary

Restore Organization ID methods in IdentityProviderModel

Reintroduces legacy methods to maintain backward compatibility, ensuring older integrations continue to function without breaking changes. This change prevents potential integration failures for clients relying on the deprecated API.

Health Assessment

• • Quick turnaround with minimal changes and a single review, indicating a straightforward compatibility fix.

Summary

Fix Admin API v2 docs to show searchable fields

Ensures admin API documentation only lists searchable fields, improving clarity for administrators. This reduces confusion and aligns docs with actual API behavior.

Health Assessment

• • Quick review and single commit indicate a straightforward fix with minimal rework.

Summary

Use prefix search in the admin console user picker

Switches the user picker to prefix search, dramatically speeding LDAP queries and adding descriptive results for email and name, improving admin efficiency.

Health Assessment

• • Fast review with minimal rework and comprehensive tests, indicating a low-risk, high-impact change.

Summary

Update to Maven 3.9.16

Upgrade Maven to the latest version to improve build stability and security for the Keycloak project.

Health Assessment

• • Quick merge with minimal changes, indicating low risk and efficient review.

Summary

Enforce manage organization for org group mapper

This change tightens security by requiring manage organization permission for modifying organization group mappers, preventing unauthorized changes that could affect organization-level access control.

Health Assessment

• • The PR was reviewed immediately and merged after a single review cycle, indicating efficient collaboration, but the large code addition and security nature suggest moderate risk.

Summary

Fix PathMatcher bypass for security vulnerability

Removes a path matching flaw that allowed bypass via percent‑encoded characters, protecting against unauthorized access.

Health Assessment

• • The PR addressed a critical CVE with a single review cycle, indicating efficient review but a substantial code change of 421 added lines across four files.

Summary

Update downstream guide with MCv2 changes

This PR updates the high‑availability documentation to reflect MCv2 changes, improving clarity for deployment and upgrade scenarios.

Health Assessment

• • The PR was reviewed quickly but required several iterations to address AI-generated review comments, indicating efficient collaboration but some initial clarity issues.

Summary

Upgrade to infinispan 16.0.15

This PR upgrades the Infinispan dependency to version 16.0.15, ensuring compatibility and security updates for high‑availability deployments.

Health Assessment

• • The PR had a single commit and a single review comment after 67 hours, indicating a straightforward dependency upgrade with minimal friction.

Summary

Cache the maven wrapper when building on GHI

Adds caching for the Maven wrapper in GitHub Actions to speed up builds and reduce flaky tests.

Health Assessment

• • Fast review and minimal changes indicate a straightforward CI improvement.

Summary

Cache the maven wrapper when building on GHI

Adds caching for the Maven wrapper in GitHub Actions to speed up builds and reduce flaky test failures.

Health Assessment

• • Fast review and minimal changes indicate a straightforward CI improvement with low risk.