48 lines
2.5 KiB
Text
48 lines
2.5 KiB
Text
= Highlights
|
|
|
|
== Vault
|
|
|
|
Several configuration fields can obtain their value from
|
|
a vault instead of entering the value directly: LDAP bind password,
|
|
SMTP password, and identity provider secrets.
|
|
|
|
Furthermore, new vault SPI has been introduced to enable development
|
|
of extensions to access secrets from custom vaults.
|
|
|
|
== Messages in theme resources
|
|
|
|
Message bundles in theme resources enables internationalization of custom providers such as authenticators. They are also shared between all theme types, making it possible to for example share messages between the login and account console. Thanks to https://github.com/micedre[micedre].
|
|
|
|
== RoleMappingsProvider SPI for the SAML adapters
|
|
|
|
We have added a new SPI that allows for the configuration of custom role mappers that are used by the SAML adapters to map
|
|
the roles extracted from the SAML assertion into roles that exist in the SP application environment. This is particularly useful
|
|
when the adapters need to communicate with third party IDPs and the roles set by the IDP in the assertion do not correspond to
|
|
the roles that were defined for the SP application. The provider to be used can configured in the `keycloak-saml.xml`
|
|
file or in the `keycloak-saml` subsystem. An implementation that performs the role mappings based on the contents of a properties
|
|
file was also provided.
|
|
|
|
Notice that when {project_name} acts as the IDP we can use the built-in role mappers to perform any necessary mappings
|
|
before setting the roles into the assertion, so this SPI will probably be redundant in this case. The `RoleMappingsProvider`
|
|
SPI was designed for situations when the IDP offer no way to map roles before adding them to the assertion.
|
|
|
|
== WildFly 18 Upgrade
|
|
|
|
Keycloak server was upgraded to use WildFly 18 under the covers.
|
|
|
|
== W3C Web Authentication support
|
|
|
|
In this release, we added initial support for W3C Web Authentication (WebAuthn). There are a few limitations in current implementation,
|
|
however we are working on further improvements in this area. Thanks to https://github.com/tnorimat[tnorimat] for the contribution. Also thanks to
|
|
https://github.com/ynojima[ynojima] for the help and feedback.
|
|
|
|
|
|
= Other Improvements
|
|
|
|
== System properties and environment variables support in theme.properties
|
|
|
|
It is now possible to use system properties and environment variables within theme.properties file. Thanks to https://github.com/Opa-[Opa-]
|
|
|
|
== Support more signing algorithms for client authentication with signed JWT
|
|
|
|
Thanks to https://github.com/tnorimat[tnorimat], we support more signing algorithms for client authentication with signed JWT.
|