Changelog#
This changelog documents all notable changes to the Keycloak app. Keep a Changelog is the format and this project adheres to Semantic Versioning.
Please also consider the upstream release notes.
22.0.3-ucs2#
Released: 20. December 2023
Using an Oracle DB backend for Keycloak is no longer possible. The Oracle DB drivers that were provided by Keycloak have been removed. If you are currently using an Oracle DB as a backend for Keycloak, a migration according to ref:app-database-custom is necessary to continue using this app.
The container of the Keycloak app has been changed from the upstream Redhat ubi-micro-build to the ucs-base-image, which is based on Debian.
The Keycloak app added support for PostgreSQL 15 databases.
The error messages shown during login using Keycloak have been adapted to show more detailed information in case an account is locked, expired or disabled.
22.0.3-ucs1#
Released: 27. September 2023
The app setting
keycloak/themehas been removed. The UCS theme, controlled by the UCR variableucs/web/themeis now used.The Keycloak app supports configurable links below the login dialog on the login page.
When opening the login page provided by Keycloak for the first time, the page shows a cookie banner, if the administrator has configured it. Users must accept the cookie banner, otherwise they can’t continue to use Keycloak.
The app updates to Keycloak version 22.0.3 of the upstream Docker image from https://quay.io/repository/keycloak/keycloak.
22.0.1-ucs1#
Released: 30. August 2023
The app updates to Keycloak version 22.0.1 of the upstream Docker image from https://quay.io/repository/keycloak/keycloak.
21.1.2-ucs2#
Released: 18. August 2023
The app can now be configured to restrict access to certain apps using group memberships. For more information about the configuration of this feature, see Restrict access to applications.
If the Keycloak hostname is accessed using http, you are now directly redirected to https
Due to longer replication times during password updates, it could happen that after a successful password update during the Keycloak login an error was shown. This has been fixed.
21.1.2-ucs1#
Released: 19. July 2023
The app updates to Keycloak version 21.1.2 of the upstream Docker image from https://quay.io/repository/keycloak/keycloak.
21.1.1-ucs1#
Released: 5. July 2023
The app updates to Keycloak version 21.1.1 of the upstream Docker image from https://quay.io/repository/keycloak/keycloak. See release notes for Keycloak 21.1.0 for more details.
The app now configures Kerberos ticket authentication through the web browser. For more information, see Activating Kerberos authentication.
21.0.1-ucs4#
Released: 28. June 2023
A Base64 NameID mapper has been added, to make the migration of the Microsoft365 connector to Keycloak possible.
21.0.1-ucs3#
Released: 31. May 2023
The UCR variable
keycloak/apache/configreplaces the variableucs/server/sso/virtualhost. In case you setucs/server/sso/virtualhosttofalseto turn off the UCS web server configuration for Keycloak, setkeycloak/apache/configtotruebefore the update.The app can use a different URL path for the single sign-on endpoint. For more information about the configuration, see Single sign-on through external public domain name.
21.0.1-ucs2#
Released: 28. April 2023
The Keycloak app can use an external fully qualified domain name. For more information about the configuration, see Single sign-on through external public domain name.
21.0.1-ucs1#
Released: 19. April 2023
From this version on the Keycloak app requires a CPU that supports the micro architecture level
x86-64-v2. For more information, see Univention Help 21420.The app updates Keycloak to version 21.0.1 of the upstream Docker image from keycloak / keycloak - Quay. See release notes for Keycloak 21.0.0 for more details.
Accessing the
userinfoendpoint now requires inclusion ofopenidin the list of requested scopes. For background information, see this upstream issue.
19.0.2-ucs2#
Released: 23. March 2023
This release of the Keycloak app includes extensions for
Univention LDAP mapper
Univention Password reset
Univention Self service
Keycloak now checks the password expiry during the sign-in and presents a password change dialog if the password has expired.
The app now offers a setting to deny the sign-in for unverified, self registered user accounts. For more information, see use cases.
19.0.1-ucs3#
Released: 14. October 2022
This release of the Keycloak app includes an extended version of the command line program univention-keycloak. Use it to directly create Keycloak Client configurations for SAML Service Providers and OpenID Connect Relying Parties.
19.0.1-ucs2#
Released: 9. September 2022
This release of the Keycloak app includes an SPI extension for so called ad-hoc federation. See the documentation for details.
Administrators can install the app Keycloak on UCS 5.0-x UCS Primary Directory Nodes. For more information, see Installation on UCS.
19.0.1-ucs1#
Released: 7. September 2022
The app now offers univention-keycloak, a command line program to configure SAML SP and OIDC Provider clients in Keycloak directly.
univention-keycloak simplifies the integration of client apps with Keycloak and the downloads of signing certificates for example as PEM file (see option groups
saml/idp/certoroidc/op/cert).univention-keycloak supports the setup of a 2FA authentication flow for the members of a specific LDAP group. The second factor is a time-based one-time password (TOTP) in this case.
The app updates to Keycloak version 19.0.1 of the upstream Docker image from https://quay.io/repository/keycloak/keycloak.
Administrators can install the app Keycloak on UCS 5.0-x UCS Primary Directory Nodes. For more information, see Installation on UCS.
18.0.0-ucs1#
Released: 28. June 2022
Initial release of the app.
Administrators can install the Keycloak app on UCS 5.0-x Primary Directory Nodes.
The app uses the upstream Docker image from https://quay.io/repository/keycloak/keycloak.