80 lines
No EOL
5.1 KiB
Text
80 lines
No EOL
5.1 KiB
Text
= Metrics for embedded caches enabled by default
|
|
|
|
Metrics for the embedded caches are now enabled by default.
|
|
To enable histograms for latencies, set the option `cache-metrics-histograms-enabled` to `true`.
|
|
|
|
= Metrics for HTTP endpoints enabled by default
|
|
|
|
The metrics provided by {project_name} now include HTTP server metrics starting with `http_server`.
|
|
See below for some examples.
|
|
|
|
[source]
|
|
----
|
|
http_server_active_requests 1.0
|
|
http_server_requests_seconds_count{method="GET",outcome="SUCCESS",status="200",uri="/realms/{realm}/protocol/{protocol}/auth"} 1.0
|
|
http_server_requests_seconds_sum{method="GET",outcome="SUCCESS",status="200",uri="/realms/{realm}/protocol/{protocol}/auth"} 0.048717142
|
|
----
|
|
|
|
|
|
= Nonce claim is only added to the ID token
|
|
|
|
The nonce claim is now only added to the ID token strictly following the OpenID Connect Core 1.0 specification. As indicated in the specification, the claim is compulsory inside the https://openid.net/specs/openid-connect-core-1_0.html#IDToken[ID token] when the same parameter was sent in the authorization request. The specification also recommends to not add the `nonce` after a https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse[refresh request]. Previously, the claim was set to all the tokens (Access, Refresh and ID) in all the responses (refresh included).
|
|
|
|
A new `Nonce backwards compatible` mapper is also included in the software that can be assigned to client scopes to revert to the old behavior. For example, the JS adapter checked the returned `nonce` claim in all the tokens before fixing issue https://github.com/keycloak/keycloak/issues/26651[#26651] in version 24.0.0. Therefore, if an old version of the JS adapter is used, the mapper should be added to the required clients by using client scopes.
|
|
|
|
= Limiting memory usage when consuming HTTP responses
|
|
|
|
In some scenarios like brokering Keycloak uses HTTP to talk to external servers.
|
|
To avoid a denial of service when those providers send too much data, {project_name} now restricts responses to 10 MB by default.
|
|
|
|
Users can configure this limit by setting the provider configuration option `spi-connections-http-client-default-max-consumed-response-size`:
|
|
|
|
.Restricting the consumed responses to 1 MB
|
|
[source,bash]
|
|
----
|
|
bin/kc.[sh|bat] --spi-connections-http-client-default-max-consumed-response-size=1000000
|
|
----
|
|
|
|
= Hostname Verification Policy
|
|
|
|
The default for `spi-truststore-file-hostname-verification-policy` and the new `tls-hostname-verifier` option is now DEFAULT, rather than WILDCARD. The WILDCARD and STRICT option values have been deprecated - you should simply rely upon DEFAULT instead.
|
|
|
|
Behavior supported by WILDCARD, that is not supported by DEFAULT:
|
|
* allows wildcards in subdomain names (e.g. *.foo.com) to match anything, including multiple levels (e.g. a.b.foo.com).
|
|
* allows matching against well known public suffixes - e.g. foo.co.gl may match *.co.gl
|
|
|
|
Behavior supported by STRICT, that is not supported by DEFAULT:
|
|
* STRICT uses a small exclusion list for 2 or 3 letter domain names ending in a 2 letter top level (*.XXX.YY) when determining if a wildcard matches. Instead DEFAULT uses a more complete list of public suffix rules and exclusions from https://publicsuffix.org/list/
|
|
|
|
It is not expected that you should be relying upon these behaviors from the WILDCARD or STRICT options.
|
|
|
|
= Removed a model module
|
|
|
|
The module `org.keycloak:keycloak-model-legacy` module was deprecated in a previous release and is removed in this release. Use the `org.keycloak:keycloak-model-storage` module instead.
|
|
|
|
= XA Transaction Changes
|
|
|
|
* The option `transaction-xa-enabled` will default to false, rather than true. If you want XA transaction support you will now need to explicitly set this option to true.
|
|
* XA Transaction recovery support is enabled by default if `transaction-xa-enabled` is true. Transaction logs will be stored at KEYCLOAK_HOME/data/transaction-logs.
|
|
|
|
= Removed offline session preloading
|
|
|
|
The old behavior to preload offline sessions at startup is now removed after it has been deprecated in the previous release.
|
|
|
|
= kcadm Changes
|
|
|
|
How kcadm parses and handles options and parameters has changed. Error messages from usage errors, the wrong option or parameter, may be slightly different than previous versions. Also usage errors will have an exit code of 2 instead of 1.
|
|
|
|
= Removing custom user attribute indexes
|
|
|
|
When searching for users by user attribute, Keycloak no longer searches for user attribute names forcing lower case comparisons. This means Keycloak's native index on the user attribute table will now be used when searching. If you have created your own index based on `lower(name)`to speed up searches, you can now remove it.
|
|
|
|
= New default client scope `basic`
|
|
|
|
The new client scope named `basic` is added as a realm "default" client scope and hence will be added to all newly created clients. The client scope is also automatically added to all existing clients during migration.
|
|
|
|
This scope contains preconfigured protocol mappers for the following claims:
|
|
|
|
* `auth_time`
|
|
|
|
This helps to reduce even more the number of claims in a lightweight access token, but also gives the chance to configure claims that were always added automatically. |