We added support for Client Scopes, which replaces Client Templates. Client Scopes are a more flexible approach and also provides
better support for the OAuth
There are changes related to Client Scopes to the consent screen. The list on the consent screen is now linked to client scopes instead of protocol mappers and roles.
See the documentation and migration guide for more details.
We now have a partial implementation of the specification
OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens .
More accurately we have support for the Certificate Bound Access Tokens. If your confidential client is able to use 2-way SSL,
Keycloak will be able to add the hash of the client certificate into the tokens issued for the client. At this moment,
it’s just the Keycloak itself, which verifies the token hashes (for example during
refresh token requests).
We plan to add support to adapters as well. We also plan to add support for Mutual TLS Client Authentication.
Thanks to tnorimat for the contribution.
UMA 2.0 is now supported for Authorization Services, including support for users to manage user access through the account management console. There are also other additions and improvements to authorization services.
Clients can now push additional claims and have them used by policies when evaluating permissions.
It is now possible to hot-deploy themes to Keycloak through a regular provider deployment. We have also added support for theme resources, which allows adding additional templates and resources without creating a theme. This is useful for custom authenticators that require additional pages to be added to the authentication flow.
We have also added support to override the theme for specific clients. If that is not adequate for your needs, then there is also a new Theme Selector SPI that allows you to implement custom logic to select the theme.
We have added support to login with Instagram. Thanks to hguerrero for the contribution.
To search for a user by id in the admin console you previously had to edit the URL. It is now possible to search directly in the user search field.