What Is New in Keycloak 26.2
| Category | Description |
|---|---|
| New Features | OAuth 2.0 Demonstrating Proof-of-Possession (DPoP), Client Credentials Grant with DCR, Declarative User Profile, and new Account Console. |
| Improvements | Enhanced OpenID Connect logout, SAML identity provider mapper, and JavaScript policy support for client scopes. |
| Deprecations | Legacy account management console and WildFly-based distribution. |
| Bug Fixes | Numerous fixes across authentication flows, user management, and admin console. |
What are the major security enhancements in 26.2?
OAuth 2.0 DPoP is the headline security feature. It binds access tokens to a specific client, preventing token replay if they're stolen. This is a significant step up from bearer tokens.
Client Credentials Grant with Dynamic Client Registration (DCR) allows for a more secure and automated way to provision machine-to-machine clients. You can now get access tokens right after registering a client without a separate secret generation step.
How does the new Declarative User Profile work?
It replaces the old programmatic approach for managing user attributes. Instead of writing code, you define validation rules, permissions, and required fields in a JSON configuration file.
In practice, this makes it much easier to enforce consistency and manage user schema changes. You can configure things like which attributes are required, read-only, or editable by the user in their account console, all through configuration.
What's new with the Account Console?
The legacy account console is now deprecated and replaced by the new one based on Keycloak's theme system. The new console is the default and offers a more modern user experience.
This change matters because it's built with the same theming tools you use for the rest of Keycloak, making customization and branding far more straightforward than hacking the old GWT-based UI.
Are there any important deprecations I should know about?
Yes, the WildFly distribution is now deprecated. The recommendation is to use the new Quarkus-based distribution, which offers faster startup times and a smaller memory footprint.
Start planning your migration to Quarkus. The legacy account console is also deprecated, so any customizations there need to be ported over to the new themeable console.
FAQ
Does DPoP require changes on my client applications?
Yes, clients must be updated to generate DPoP proof JWTs and bind them to their HTTP requests. It's not a transparent server-side change.
Can I still use the old WildFly distribution?
Yes, for now, but it's deprecated. You should begin testing your deployment on the Quarkus-based distribution, which is the future of Keycloak.
Is the Declarative User Profile backward compatible?
For most setups, yes. However, if you have complex customizations using the old provider SPI, you may need to adapt your code to work with the new JSON-based configuration.
What happens if I don't migrate from the legacy account console?
It will continue to work in this release but will likely be removed in a future major version. The new console is the supported path forward.
How do Client Credentials with DCR improve security?
It reduces the window of exposure by eliminating the manual step of retrieving a client secret after registration. The client can be registered and immediately start using a token, which is better for automated, secure workflows.