# Latest **URL:** https://forum.keycloak.org/latest.md [Latest](https://forum.keycloak.org/latest.md) · [Categories](https://forum.keycloak.org/categories.md) · [Tags](https://forum.keycloak.org/tags.md) --- ## [Keycloak 26.7.1 rejecting request from Claude](https://forum.keycloak.org/t/keycloak-26-7-1-rejecting-request-from-claude/31660)
**Author:** [@nlaskhmi](https://forum.keycloak.org/u/nlaskhmi)\ **Replies:** 1\ **Last updated:** [September 1, 2026, 2:35pm UTC](https://forum.keycloak.org/t/keycloak-26-7-1-rejecting-request-from-claude/31660 "2026-09-01T14:35:00Z")
Hello Team, I work for Simplicontract Technologies. We use Keycloak as our IDP. We were on 23, but now we want to integrate external MCP clients like Claude Desktop, Copilot, Cursor with our MCP server. We have upgraded… --- ## [Keycloak read/write splitting with aws advanced jdbc](https://forum.keycloak.org/t/keycloak-read-write-splitting-with-aws-advanced-jdbc/31656)
**Author:** [@khanhlv2093](https://forum.keycloak.org/u/khanhlv2093)\ **Replies:** 1\ **Last updated:** [August 23, 2026, 12:07pm UTC](https://forum.keycloak.org/t/keycloak-read-write-splitting-with-aws-advanced-jdbc/31656 "2026-08-23T12:07:12Z")
I have been trying to integrate Keycloak with the AWS Advanced JDBC Wrapper + Aurora. I will configure autoReadWriteSplitting with two endpoints — one is the writer and the other is the reader. It will automatically anal… --- ## [How to override AssertionConsumerServiceURL in SAML AuthnRequest when Keycloak acts as SP (Identity Broker)?](https://forum.keycloak.org/t/how-to-override-assertionconsumerserviceurl-in-saml-authnrequest-when-keycloak-acts-as-sp-identity-broker/31298)
**Author:** [@sumeetpri](https://forum.keycloak.org/u/sumeetpri)\ **Replies:** 1\ **Last updated:** [August 20, 2026, 7:57am UTC](https://forum.keycloak.org/t/how-to-override-assertionconsumerserviceurl-in-saml-authnrequest-when-keycloak-acts-as-sp-identity-broker/31298 "2026-08-20T07:57:08Z")
Context We are migrating an existing SAML Service Provider (SP) application to Keycloak, where Keycloak will act as an SP and broker authentication to multiple external customer Identity Providers (IdPs). To ensure ze… --- ## [Keycloak setup for ID Austria (with transient sub)](https://forum.keycloak.org/t/keycloak-setup-for-id-austria-with-transient-sub/31657)
**Author:** [@ThriceGood](https://forum.keycloak.org/u/ThriceGood)\ **Replies:** 1\ **Last updated:** [August 20, 2026, 6:15am UTC](https://forum.keycloak.org/t/keycloak-setup-for-id-austria-with-transient-sub/31657 "2026-08-20T06:15:26Z")
Hello, I have not yet figured out from the docs and various bits of information online if Keycloak will work out of the box with ID Austria as an external IdP. I have seen some discussions with people writing their own … --- ## [Configuring/federating user and groups from AD Ldap](https://forum.keycloak.org/t/configuring-federating-user-and-groups-from-ad-ldap/31655)
**Author:** [@tochin](https://forum.keycloak.org/u/tochin)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 3:17pm UTC](https://forum.keycloak.org/t/configuring-federating-user-and-groups-from-ad-ldap/31655 "2026-08-18T15:17:48Z")
We are attempting to federate users and groups from AD LDAP into Keycloak. We do not want to maintain a live connection to LDAP so we are using a Sync Mode of Import. We ideally would like the entire LDAP tree to be st… --- ## [Key-Cache trigger/refresh](https://forum.keycloak.org/t/key-cache-trigger-refresh/31654)
**Author:** [@VincentS](https://forum.keycloak.org/u/VincentS)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 2:23pm UTC](https://forum.keycloak.org/t/key-cache-trigger-refresh/31654 "2026-08-18T14:23:00Z")
Hello, Currently i am building a Keycloak IDP with ~180 connected clients for which i’m using Metadata Descriptor URL. I am looking for a way to refresh/trigger the metadata. Because if something changes in the metadata… --- ## [Keycloak 26.7.0 + Oracle via Kerberos](https://forum.keycloak.org/t/keycloak-26-7-0-oracle-via-kerberos/31652)
**Author:** [@cestfe](https://forum.keycloak.org/u/cestfe)\ **Replies:** 0\ **Last updated:** [August 11, 2026, 4:19pm UTC](https://forum.keycloak.org/t/keycloak-26-7-0-oracle-via-kerberos/31652 "2026-08-11T16:19:03Z")
I am trying to connect Keycloak to Oracle via Kerberos. I have not succeeded despite several attempts using different configurations. FailMsg: ORA-01017: username/password; logon denied My Kerberos connection has been … --- ## [Keycloak 26.7.1 released](https://forum.keycloak.org/t/keycloak-26-7-1-released/31650)
**Author:** [@hramos](https://forum.keycloak.org/u/hramos)\ **Replies:** 0\ **Last updated:** [August 6, 2026, 10:59am UTC](https://forum.keycloak.org/t/keycloak-26-7-1-released/31650 "2026-08-06T10:59:17Z")
Link: Keycloak 26.7.1 released - Keycloak --- ## [Reccomandations for upgrade from 11-0-0-1 to 26.7.0](https://forum.keycloak.org/t/reccomandations-for-upgrade-from-11-0-0-1-to-26-7-0/31648)
**Author:** [@condaru321](https://forum.keycloak.org/u/condaru321)\ **Replies:** 3\ **Last updated:** [August 6, 2026, 10:55am UTC](https://forum.keycloak.org/t/reccomandations-for-upgrade-from-11-0-0-1-to-26-7-0/31648 "2026-08-06T10:55:35Z")
Hello, I want to upgrade one of my keycloak solutions from 11-0-0-1 to 26.7.0 . The old one is hosted in Openshift and is connected to a MariaDB(10.11.0) instance and the new one is hosted in GKE and connected to a PG… --- ## [Groupmembership are not visible anymore at Keycloak UI after upgrade from version 26.6.4 to 26.7.0](https://forum.keycloak.org/t/groupmembership-are-not-visible-anymore-at-keycloak-ui-after-upgrade-from-version-26-6-4-to-26-7-0/31642)
**Author:** [@norbert.pourie](https://forum.keycloak.org/u/norbert.pourie)\ **Replies:** 2\ **Last updated:** [August 6, 2026, 10:17am UTC](https://forum.keycloak.org/t/groupmembership-are-not-visible-anymore-at-keycloak-ui-after-upgrade-from-version-26-6-4-to-26-7-0/31642 "2026-08-06T10:17:17Z")
We upgraded from Keycloak version 26.6.4 to 26.7.0 and recognized that now the groupmembership imported from AD via LDAP-Föderation is not showing up anymore at Keycloak UI at the groups membership tab. The membership at… --- ## [404 when trying to download sha1 for Keycloka 26.7.0](https://forum.keycloak.org/t/404-when-trying-to-download-sha1-for-keycloka-26-7-0/31640)
**Author:** [@mthethwa](https://forum.keycloak.org/u/mthethwa)\ **Replies:** 1\ **Last updated:** [July 23, 2026, 2:29pm UTC](https://forum.keycloak.org/t/404-when-trying-to-download-sha1-for-keycloka-26-7-0/31640 "2026-07-23T14:29:52Z")
I could not download sha1 from here: https://github.com/keycloak/keycloak/releases/download/26.7.0/keycloak-26.7.0.tar.gz.sha1 --- ## [Performance test of Keycloak as Identity broker](https://forum.keycloak.org/t/performance-test-of-keycloak-as-identity-broker/31641)
**Author:** [@silapen](https://forum.keycloak.org/u/silapen)\ **Replies:** 2\ **Last updated:** [July 23, 2026, 6:58am UTC](https://forum.keycloak.org/t/performance-test-of-keycloak-as-identity-broker/31641 "2026-07-23T06:58:34Z")
Is there a way to test Keycloak performance if I have a flow where user on first login is redirected to other connected IdP? For example, I setup “Login with Google”, or another instance of Keycloak, also known as Ident… --- ## [{“errorMessage”:”Bad Request”} when using admin api](https://forum.keycloak.org/t/errormessage-bad-request-when-using-admin-api/31599)
**Author:** [@Bily-SX](https://forum.keycloak.org/u/Bily-SX)\ **Replies:** 0\ **Last updated:** [July 16, 2026, 2:46am UTC](https://forum.keycloak.org/t/errormessage-bad-request-when-using-admin-api/31599 "2026-07-16T02:46:34Z")
I am trying to use the admin api to update user info but when the api is called it returns this error: {StatusCode: 400, ReasonPhrase: 'Bad Request'} PUT /admin/realms/{realm}/users/{user-id} The weird part is that wh… --- ## [Transient Connection refused between nodes when using docker stop](https://forum.keycloak.org/t/transient-connection-refused-between-nodes-when-using-docker-stop/31590)
**Author:** [@smcclem](https://forum.keycloak.org/u/smcclem)\ **Replies:** 0\ **Last updated:** [July 9, 2026, 8:00pm UTC](https://forum.keycloak.org/t/transient-connection-refused-between-nodes-when-using-docker-stop/31590 "2026-07-09T20:00:28Z")
Greetings and salutations. We’re investigating whether our Keycloak nodes are leaving the cluster cleanly during deploy shutdown. Setup: 3 individual VM hosts, each running one Keycloak 26.4.2 Docker container. The node… --- ## [Three moderate, unpatched Keycloak advisories in 26.6.4](https://forum.keycloak.org/t/three-moderate-unpatched-keycloak-advisories-in-26-6-4/31584)
**Author:** [@jonnewell](https://forum.keycloak.org/u/jonnewell)\ **Replies:** 1\ **Last updated:** [July 9, 2026, 9:07am UTC](https://forum.keycloak.org/t/three-moderate-unpatched-keycloak-advisories-in-26-6-4/31584 "2026-07-09T09:07:12Z")
CVE‑2026‑9689 (GHSA‑wcvj‑vpvw‑9rr5) — redirect‑URI HTTP parameter pollution CVE‑2026‑9798 (GHSA‑q6h7‑xxp7‑7429) — CIBA brute‑force‑protection bypass CVE‑2026‑9793 (GHSA‑p3v8‑fm5p‑v84h) — JWE unsigned‑claims signa… --- ## [Best practice for multi-user-type access: single realm vs. multiple realms?](https://forum.keycloak.org/t/best-practice-for-multi-user-type-access-single-realm-vs-multiple-realms/31355)
**Author:** [@pdany1116](https://forum.keycloak.org/u/pdany1116)\ **Replies:** 3\ **Last updated:** [July 4, 2026, 2:42pm UTC](https://forum.keycloak.org/t/best-practice-for-multi-user-type-access-single-realm-vs-multiple-realms/31355 "2026-07-04T14:42:56Z")
Hi all, I’m evaluating Keycloak as the central IdP for our organization and looking for guidance on how to architect user and access separation across different application types. User types Our organization has three… --- ## [HPA scale up and down - infinispan rebalance](https://forum.keycloak.org/t/hpa-scale-up-and-down-infinispan-rebalance/31583)
**Author:** [@jonnewell](https://forum.keycloak.org/u/jonnewell)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 6:05pm UTC](https://forum.keycloak.org/t/hpa-scale-up-and-down-infinispan-rebalance/31583 "2026-07-01T18:05:12Z")
It seems like scaling up keycloak pods quickly can cause a good amount of infinispan thrash for rebalances? Can anyone share their HPA configs? This is my current config but its junk lol autoscaling: enabled: tr… --- ## [Passkey logins don't last long](https://forum.keycloak.org/t/passkey-logins-dont-last-long/31581)
**Author:** [@hmof](https://forum.keycloak.org/u/hmof)\ **Replies:** 1\ **Last updated:** [July 1, 2026, 6:43am UTC](https://forum.keycloak.org/t/passkey-logins-dont-last-long/31581 "2026-07-01T06:43:15Z")
I’ve upgraded my existing realm to the latest browser authentication flow in order to login with a passkey, passwordless. However, I seem to have to login multiple times per day now. When I login with a password and “re… --- ## [Keycloak 26.6.0 - moving from utf8mb3 to utf8mb4 on MariaDB](https://forum.keycloak.org/t/keycloak-26-6-0-moving-from-utf8mb3-to-utf8mb4-on-mariadb/31378)
**Author:** [@TwizzyDizzy](https://forum.keycloak.org/u/TwizzyDizzy)\ **Replies:** 1\ **Last updated:** [June 30, 2026, 12:44pm UTC](https://forum.keycloak.org/t/keycloak-26-6-0-moving-from-utf8mb3-to-utf8mb4-on-mariadb/31378 "2026-06-30T12:44:00Z")
Hi folks, first-timer here :waving\_hand: (that’s why I have to put some links as code block, as I cannot have more than two links in my first post). In the “notable changes” section of the upgrade guide for Keycloak 26… --- ## [How to troubleshoot 'SSLHandshakeFailed' when trying to connect to LDAP](https://forum.keycloak.org/t/how-to-troubleshoot-sslhandshakefailed-when-trying-to-connect-to-ldap/31270)
**Author:** [@joost](https://forum.keycloak.org/u/joost)\ **Replies:** 6\ **Last updated:** [June 16, 2026, 6:19pm UTC](https://forum.keycloak.org/t/how-to-troubleshoot-sslhandshakefailed-when-trying-to-connect-to-ldap/31270 "2026-06-16T18:19:22Z")
Hi all, Since last weekend, ldap users, from a specific “user federation” had their login denied. Presumably because of security update of our OpenSSL. OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) … --- ## [Login page not loading in Iphones](https://forum.keycloak.org/t/login-page-not-loading-in-iphones/31384)
**Author:** [@sanujaediri](https://forum.keycloak.org/u/sanujaediri)\ **Replies:** 3\ **Last updated:** [June 15, 2026, 6:09am UTC](https://forum.keycloak.org/t/login-page-not-loading-in-iphones/31384 "2026-06-15T06:09:27Z")
the login pages do not load only in iPhones when requested. i have checked with multiple iphone versions, android phones, macbooks, ubuntu and windows PCs. issue exists for the custom login page for a realm I have create… --- ## [Client not allowed to exchange](https://forum.keycloak.org/t/client-not-allowed-to-exchange/31410)
**Author:** [@anderson-gusmao](https://forum.keycloak.org/u/anderson-gusmao)\ **Replies:** 2\ **Last updated:** [June 14, 2026, 10:49pm UTC](https://forum.keycloak.org/t/client-not-allowed-to-exchange/31410 "2026-06-14T22:49:31Z")
Hello everyone, I need some help understanding how token exchange works in Keycloak. I’ve spent several hours trying to solve an issue and would appreciate any guidance. I’m running Keycloak 26.6.3. One thing that has… --- ## [Regex in OIDC redirect URI](https://forum.keycloak.org/t/regex-in-oidc-redirect-uri/31390)
**Author:** [@manavgupta](https://forum.keycloak.org/u/manavgupta)\ **Replies:** 1\ **Last updated:** [June 3, 2026, 11:46am UTC](https://forum.keycloak.org/t/regex-in-oidc-redirect-uri/31390 "2026-06-03T11:46:56Z")
Currently keycloak only supports wildcards for the redirectURI, which hands down is insecure as-it-is. Is there a way to add a regex(I know it’s not officially supported, but has anyone tried a workaround for that). Any … --- ## [Keycloak Admin UI: Client - Authorization - Evaluate - Resources and Scopes - Key search does not work](https://forum.keycloak.org/t/keycloak-admin-ui-client-authorization-evaluate-resources-and-scopes-key-search-does-not-work/31389)
**Author:** [@Keycloak123](https://forum.keycloak.org/u/Keycloak123)\ **Replies:** 0\ **Last updated:** [June 1, 2026, 3:37pm UTC](https://forum.keycloak.org/t/keycloak-admin-ui-client-authorization-evaluate-resources-and-scopes-key-search-does-not-work/31389 "2026-06-01T15:37:14Z")
in the Keycloak UI (version 26.4.7) we are unable to search by the resource name in the “Client - Authorization - Evaluate” screen - “Resources and Scopes - Key” control, but only select from a list of resources which … --- ## [Feature request - Set custom email attribute for SendResetPassowrd flow](https://forum.keycloak.org/t/feature-request-set-custom-email-attribute-for-sendresetpassowrd-flow/31379)
**Author:** [@muppeth](https://forum.keycloak.org/u/muppeth)\ **Replies:** 2\ **Last updated:** [May 29, 2026, 7:32am UTC](https://forum.keycloak.org/t/feature-request-set-custom-email-attribute-for-sendresetpassowrd-flow/31379 "2026-05-29T07:32:01Z")
Our platform offers email addresses to their users and stores those in email attribue on ldap and soon planned on Keycloak where we are migrating to. However if a user issues password reset for example, the rest code/lin… --- ## [OIDC Identity Provider (ADFS): scope not sent in token exchange request, groups claim missing](https://forum.keycloak.org/t/oidc-identity-provider-adfs-scope-not-sent-in-token-exchange-request-groups-claim-missing/31387)
**Author:** [@Kaushik](https://forum.keycloak.org/u/Kaushik)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 5:01pm UTC](https://forum.keycloak.org/t/oidc-identity-provider-adfs-scope-not-sent-in-token-exchange-request-groups-claim-missing/31387 "2026-05-28T17:01:31Z")
Environment: Keycloak 26.2.4 (Quarkus), Oracle DB, ADFS as OIDC Identity Provider Issue 1: Scope not included in token exchange POST request We have Keycloak brokering authentication to Microsoft ADFS via OIDC. ADFS re… --- ## [Recommended way to impersonate a user and add impersonator\_uuid claim?](https://forum.keycloak.org/t/recommended-way-to-impersonate-a-user-and-add-impersonator-uuid-claim/31386)
**Author:** [@pesseyjulien](https://forum.keycloak.org/u/pesseyjulien)\ **Replies:** 1\ **Last updated:** [May 28, 2026, 2:07pm UTC](https://forum.keycloak.org/t/recommended-way-to-impersonate-a-user-and-add-impersonator-uuid-claim/31386 "2026-05-28T14:07:29Z")
Hello, I currently use a custom Keycloak endpoint to generate an access token for a target user and add a custom claim: impersonator\_uuid I would like to replace this custom endpoint with a Keycloak-native solution. T… --- ## [Conditional sub-flows not respecting user attribute condition](https://forum.keycloak.org/t/conditional-sub-flows-not-respecting-user-attribute-condition/31385)
**Author:** [@William](https://forum.keycloak.org/u/William)\ **Replies:** 0\ **Last updated:** [May 26, 2026, 8:14pm UTC](https://forum.keycloak.org/t/conditional-sub-flows-not-respecting-user-attribute-condition/31385 "2026-05-26T20:14:40Z")
I’m building a multi-MFA flow in Keycloak 26.5.1 where users can be assigned one of three MFA methods: SMS, Email OTP, or TOTP. The method is stored as a user attribute mfa\_option with values SMS, Email, or TOTP. Curren… --- ## [Redirection with AWS ALB](https://forum.keycloak.org/t/redirection-with-aws-alb/31381)
**Author:** [@SergioCea](https://forum.keycloak.org/u/SergioCea)\ **Replies:** 2\ **Last updated:** [May 25, 2026, 5:54pm UTC](https://forum.keycloak.org/t/redirection-with-aws-alb/31381 "2026-05-25T17:54:48Z")
I’m configuring Keycloak under an ALB (Area Listed Building) and so far it’s been working correctly. The problem is that I have another service that connects to Keycloak through a namespace for internal communication. T… --- ## [SSO problems and doubts](https://forum.keycloak.org/t/sso-problems-and-doubts/31370)
**Author:** [@MarcelloT](https://forum.keycloak.org/u/MarcelloT)\ **Replies:** 4\ **Last updated:** [May 20, 2026, 6:39pm UTC](https://forum.keycloak.org/t/sso-problems-and-doubts/31370 "2026-05-20T18:39:32Z")
I created a realm with two clients inside. The two clients are my webapp and Grafana. When I log in to my webapp and then open Grafana, I’m automatically logged into Grafana thanks to SSO. And so far, so good. The proble… [Next page](https://forum.keycloak.org/latest.md?page=1)