# Latest **URL:** https://forum.keycloak.org/latest.md?page=1 [Latest](https://forum.keycloak.org/latest.md) · [Categories](https://forum.keycloak.org/categories.md) · [Tags](https://forum.keycloak.org/tags.md) **Page:** 2 --- ## [Test User being unexpectedly disabled with error "user\_disabled"](https://forum.keycloak.org/t/test-user-being-unexpectedly-disabled-with-error-user-disabled/31376)
**Author:** [@andyspoon](https://forum.keycloak.org/u/andyspoon)\ **Replies:** 0\ **Last updated:** [May 20, 2026, 4:53pm UTC](https://forum.keycloak.org/t/test-user-being-unexpectedly-disabled-with-error-user-disabled/31376 "2026-05-20T16:53:01Z")
Hi all. Our web app uses KeyCloak 26.3.2 and we run smoke tests against the app. These smoke tests use the same user each time via a GitHub action. Sometimes the user gets Disabled but I don’t understand why. In the use… --- ## [Problems with logout in KC](https://forum.keycloak.org/t/problems-with-logout-in-kc/31374)
**Author:** [@MarcelloT](https://forum.keycloak.org/u/MarcelloT)\ **Replies:** 1\ **Last updated:** [May 19, 2026, 3:51pm UTC](https://forum.keycloak.org/t/problems-with-logout-in-kc/31374 "2026-05-19T15:51:34Z")
I created a test realm with two clients (oidc). When I log in to client1, I can then access client2 without logging in. In keycloak, I see the active session for my user with both clients. When I log out on one of the tw… --- ## [External-to-Internal token exchange](https://forum.keycloak.org/t/external-to-internal-token-exchange/31373)
**Author:** [@GuntherF](https://forum.keycloak.org/u/GuntherF)\ **Replies:** 1\ **Last updated:** [May 18, 2026, 7:38pm UTC](https://forum.keycloak.org/t/external-to-internal-token-exchange/31373 "2026-05-18T19:38:28Z")
Is the below statement accurate? And if so, how can we mitigate the maintainability risks relying on legacy features if Keycloak potentially deprecates them? Will support for external-to-internal token exhange be part of… --- ## [External-to-Internal Token Exchange Best Practices in v26.x: JWT Authorization Grant and Entra ID aud Claim](https://forum.keycloak.org/t/external-to-internal-token-exchange-best-practices-in-v26-x-jwt-authorization-grant-and-entra-id-aud-claim/31331)
**Author:** [@mjammal](https://forum.keycloak.org/u/mjammal)\ **Replies:** 1\ **Last updated:** [May 15, 2026, 9:42am UTC](https://forum.keycloak.org/t/external-to-internal-token-exchange-best-practices-in-v26-x-jwt-authorization-grant-and-entra-id-aud-claim/31331 "2026-05-15T09:42:54Z")
Hello, We are seeking guidance on the recommended approach for External-to-Internal Token Exchange in Keycloak v26.6.5. Our Scenario Architecture: Our application is embedded in an iframe by a third-party application. … --- ## [Reset credentials (password + OTP) stuck in a loop](https://forum.keycloak.org/t/reset-credentials-password-otp-stuck-in-a-loop/30274)
**Author:** [@REX500](https://forum.keycloak.org/u/REX500)\ **Replies:** 2\ **Last updated:** [May 14, 2026, 12:43pm UTC](https://forum.keycloak.org/t/reset-credentials-password-otp-stuck-in-a-loop/30274 "2026-05-14T12:43:04Z")
Asking as I couldn’t find a proper answer in existing threads. I am running a clean Keycloak v.26.2.5 server. I haven’t touched existing authentication flows, especially the reset credentials flow - it’s vanilla i.e. i… --- ## [Should lightweight access tokens always be introspected?](https://forum.keycloak.org/t/should-lightweight-access-tokens-always-be-introspected/31363)
**Author:** [@danilopiazza](https://forum.keycloak.org/u/danilopiazza)\ **Replies:** 6\ **Last updated:** [May 13, 2026, 8:43am UTC](https://forum.keycloak.org/t/should-lightweight-access-tokens-always-be-introspected/31363 "2026-05-13T08:43:50Z")
Are lightweight access tokens meant to be always sent to the introspection endpoint, or is it okay to validate them offline? My understanding is that checking their public key and their iat, exp, iss, and azp claims is … --- ## [For countries like Kenya sign up/in flow with just Phone number and sent OTP](https://forum.keycloak.org/t/for-countries-like-kenya-sign-up-in-flow-with-just-phone-number-and-sent-otp/31362)
**Author:** [@olal](https://forum.keycloak.org/u/olal)\ **Replies:** 3\ **Last updated:** [May 12, 2026, 9:21am UTC](https://forum.keycloak.org/t/for-countries-like-kenya-sign-up-in-flow-with-just-phone-number-and-sent-otp/31362 "2026-05-12T09:21:35Z")
As an option there should exist sign up/in with just the phone number and get the authentication token ? --- ## [Rotating DB Connection credentials using AWS Secret Manager](https://forum.keycloak.org/t/rotating-db-connection-credentials-using-aws-secret-manager/20452)
**Author:** [@Dingo](https://forum.keycloak.org/u/Dingo)\ **Replies:** 1\ **Last updated:** [May 12, 2026, 9:14am UTC](https://forum.keycloak.org/t/rotating-db-connection-credentials-using-aws-secret-manager/20452 "2026-05-12T09:14:46Z")
I am trying to utilise AWS Secrets Manager to generate and automatically rotate secrets for my DB credentials (password). From my research, it looks like one option is that the container running KeyCloak will need to be… --- ## [How do I get UserId from Keycloak using ASP.NET Web Api?](https://forum.keycloak.org/t/how-do-i-get-userid-from-keycloak-using-asp-net-web-api/31360)
**Author:** [@newUsr](https://forum.keycloak.org/u/newUsr)\ **Replies:** 1\ **Last updated:** [May 12, 2026, 9:04am UTC](https://forum.keycloak.org/t/how-do-i-get-userid-from-keycloak-using-asp-net-web-api/31360 "2026-05-12T09:04:44Z")
Currently I’m working on pet project. I’ve already done configuring to Angular + ASP.NET Project. But I tried search for information on the internet, nothing but configuring your project to your realm and client-scopes,… --- ## [Special extended access](https://forum.keycloak.org/t/special-extended-access/31361)
**Author:** [@Axel](https://forum.keycloak.org/u/Axel)\ **Replies:** 0\ **Last updated:** [May 11, 2026, 11:04am UTC](https://forum.keycloak.org/t/special-extended-access/31361 "2026-05-11T11:04:09Z")
Hello reader, I am running into two issues at the moment and have tried everything I know. MAIN GOAL: Give extended access to our main dashboard to special partners of ours. Normal access should grant 1 day sessions, ac… --- ## [KeyCloak Admin User Forbidden](https://forum.keycloak.org/t/keycloak-admin-user-forbidden/31357)
**Author:** [@amandaliberaann](https://forum.keycloak.org/u/amandaliberaann)\ **Replies:** 0\ **Last updated:** [May 7, 2026, 3:07am UTC](https://forum.keycloak.org/t/keycloak-admin-user-forbidden/31357 "2026-05-07T03:07:16Z")
Keycloak Admin REST API returns 403 for one realm but works for another using the same master admin token Hi everyone, I am stuck with a Keycloak Admin REST API permission issue. I have one Keycloak server with multipl… --- ## [Keycloak + Entra Id Request to endpoint HTTPStatusCode 400](https://forum.keycloak.org/t/keycloak-entra-id-request-to-endpoint-httpstatuscode-400/31356)
**Author:** [@hermanthotan](https://forum.keycloak.org/u/hermanthotan)\ **Replies:** 1\ **Last updated:** [May 5, 2026, 3:12pm UTC](https://forum.keycloak.org/t/keycloak-entra-id-request-to-endpoint-httpstatuscode-400/31356 "2026-05-05T15:12:03Z")
I have web app configure Keycloak with EntraID, when login with the email address is success but from the network it capture HttpStatusCode 400 https://{domain}/identity/realms/cwos-stg-entraid/broker/Azure/endpoint?cod… --- ## [No specific error message when login failed when using LDAP authentication](https://forum.keycloak.org/t/no-specific-error-message-when-login-failed-when-using-ldap-authentication/31353)
**Author:** [@arunvk-crypto](https://forum.keycloak.org/u/arunvk-crypto)\ **Replies:** 2\ **Last updated:** [May 5, 2026, 11:32am UTC](https://forum.keycloak.org/t/no-specific-error-message-when-login-failed-when-using-ldap-authentication/31353 "2026-05-05T11:32:01Z")
If the AD account of a web users requires them to reset their password. or the AD user is disabled in all there scenarios the login with keycloak will have to fail when using LDAP authentication. the login is failing but… --- ## [Tools or approaches for Keycloak DML Changes](https://forum.keycloak.org/t/tools-or-approaches-for-keycloak-dml-changes/29663)
**Author:** [@darkoandreev](https://forum.keycloak.org/u/darkoandreev)\ **Replies:** 4\ **Last updated:** [May 4, 2026, 2:10pm UTC](https://forum.keycloak.org/t/tools-or-approaches-for-keycloak-dml-changes/29663 "2026-05-04T14:10:10Z")
Hello everyone, I have the following case and question, and I would greatly appreciate your insights regarding best practices, guides, or any other relevant resources. Let’s imagine the following scenario: we have a wo… --- ## [Configuration as code and registration workflows](https://forum.keycloak.org/t/configuration-as-code-and-registration-workflows/23581)
**Author:** [@smaly](https://forum.keycloak.org/u/smaly)\ **Replies:** 3\ **Last updated:** [May 4, 2026, 2:05pm UTC](https://forum.keycloak.org/t/configuration-as-code-and-registration-workflows/23581 "2026-05-04T14:05:40Z")
I attended a workshop at WJAX 2023 with dasniko in Munich and learned some first steps in working with keycloak. Now I have two more questions since we are currently thinking about using keycloak in the future. Is confi… --- ## [Access token with introspection vs. ID token with manual inspection](https://forum.keycloak.org/t/access-token-with-introspection-vs-id-token-with-manual-inspection/31354)
**Author:** [@danilopiazza](https://forum.keycloak.org/u/danilopiazza)\ **Replies:** 1\ **Last updated:** [May 4, 2026, 9:07am UTC](https://forum.keycloak.org/t/access-token-with-introspection-vs-id-token-with-manual-inspection/31354 "2026-05-04T09:07:44Z")
My application (let’s call it “A”) is relying on Keycloak for authentication with OIDC, and everything works fine. Now, from A (on the back-end side), I need to call another application (called “B”) and I’d like to inte… --- ## [Retrieve Keycloak OIDC client secret from vault provider](https://forum.keycloak.org/t/retrieve-keycloak-oidc-client-secret-from-vault-provider/12983)
**Author:** [@lucascorailler](https://forum.keycloak.org/u/lucascorailler)\ **Replies:** 5\ **Last updated:** [April 29, 2026, 6:36pm UTC](https://forum.keycloak.org/t/retrieve-keycloak-oidc-client-secret-from-vault-provider/12983 "2026-04-29T18:36:52Z")
Hello, Is there a way to retrieve a Keycloak client’s client\_secret from the Kubernetes files plain-text vault provider ? Already did it for the SMTP password, it’s working fine, but I’d like something like this : T… --- ## [Keycloak Redis Cache extension](https://forum.keycloak.org/t/keycloak-redis-cache-extension/31334)
**Author:** [@rtufisi](https://forum.keycloak.org/u/rtufisi)\ **Replies:** 3\ **Last updated:** [April 29, 2026, 6:02pm UTC](https://forum.keycloak.org/t/keycloak-redis-cache-extension/31334 "2026-04-29T18:02:33Z")
Hello community, We are delighted to announce the release of the first version of Redis Cache extension. We’re looking for any feedback, bugs and improvement ideas. --- ## [Old password still valid after password change via keycloak](https://forum.keycloak.org/t/old-password-still-valid-after-password-change-via-keycloak/31349)
**Author:** [@cptBlackBeer](https://forum.keycloak.org/u/cptBlackBeer)\ **Replies:** 0\ **Last updated:** [April 29, 2026, 8:17am UTC](https://forum.keycloak.org/t/old-password-still-valid-after-password-change-via-keycloak/31349 "2026-04-29T08:17:55Z")
Hi everyone We observed an unusual behavior. When a user changes their password in Keycloak, the old password can still be used to log in for exactly one hour. After that, the old password stops working. We are using S… --- ## [What is the best way to auto assign a group to a user?](https://forum.keycloak.org/t/what-is-the-best-way-to-auto-assign-a-group-to-a-user/31345)
**Author:** [@vdjango](https://forum.keycloak.org/u/vdjango)\ **Replies:** 0\ **Last updated:** [April 27, 2026, 4:23pm UTC](https://forum.keycloak.org/t/what-is-the-best-way-to-auto-assign-a-group-to-a-user/31345 "2026-04-27T16:23:04Z")
Hi, I would like users that just filled a registration form to be assigned automatically to different groups. In a perfect world it would look like this : async sendRegistrationMail( mailAdress, assignedGroup ) User w… --- ## [Policy factory and getmetadata](https://forum.keycloak.org/t/policy-factory-and-getmetadata/31344)
**Author:** [@orejas](https://forum.keycloak.org/u/orejas)\ **Replies:** 0\ **Last updated:** [April 25, 2026, 12:17pm UTC](https://forum.keycloak.org/t/policy-factory-and-getmetadata/31344 "2026-04-25T12:17:01Z")
"In Keycloak 26.1.1, I am developing a custom policy that uses a web service to verify a user’s permissions for a resource. The idea is that when creating this custom policy, the client should be able to configure a REST… --- ## [Standard token exchange - Impersonation](https://forum.keycloak.org/t/standard-token-exchange-impersonation/31341)
**Author:** [@Axel](https://forum.keycloak.org/u/Axel)\ **Replies:** 2\ **Last updated:** [April 24, 2026, 3:53pm UTC](https://forum.keycloak.org/t/standard-token-exchange-impersonation/31341 "2026-04-24T15:53:16Z")
Hi there, I have a question about impersonation with token exchange. Is it correct that this feature isn’t inside standard token exchange yet? Is this something that will happen somewhere in the future? How advisable wo… --- ## [SMTP Happy Eyeballs](https://forum.keycloak.org/t/smtp-happy-eyeballs/31338)
**Author:** [@ciphermenial](https://forum.keycloak.org/u/ciphermenial)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 2:00pm UTC](https://forum.keycloak.org/t/smtp-happy-eyeballs/31338 "2026-04-22T14:00:04Z")
I have a local SMTP server configured for use with my internal servers. The SMTP server is only listening on IPv6. In the Keycloak SMTP configuration I have to manually enter the IPv6 address of the SMTP server. When I e… --- ## [Keycloak 24.0.5 - Mixed Content Issue - https \> http - JVM: 17.0.18 (Ubuntu OpenJDK 64-Bit Server VM 17.0.18+8-Ubuntu-124.04.1) - OS: Linux 6.8.0-110-generic amd64](https://forum.keycloak.org/t/keycloak-24-0-5-mixed-content-issue-https-http-jvm-17-0-18-ubuntu-openjdk-64-bit-server-vm-17-0-18-8-ubuntu-124-04-1-os-linux-6-8-0-110-generic-amd64/31340)
**Author:** [@Ahmad.Fareed](https://forum.keycloak.org/u/Ahmad.Fareed)\ **Replies:** 0\ **Last updated:** [April 22, 2026, 11:51am UTC](https://forum.keycloak.org/t/keycloak-24-0-5-mixed-content-issue-https-http-jvm-17-0-18-ubuntu-openjdk-64-bit-server-vm-17-0-18-8-ubuntu-124-04-1-os-linux-6-8-0-110-generic-amd64/31340 "2026-04-22T11:51:36Z")
I am facing issue while accessing the Keycloak by https. The Admin UI is loading, and the command curl -s https://xxxxx.com/realms/master/.well-known/openid-configuration | grep issuer The issuer output is http. --- ## [Keycloak export failed](https://forum.keycloak.org/t/keycloak-export-failed/31339)
**Author:** [@ingo](https://forum.keycloak.org/u/ingo)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 11:15am UTC](https://forum.keycloak.org/t/keycloak-export-failed/31339 "2026-04-22T11:15:57Z")
With Keycloak Version 26.6.0 the export of a realm not master failed with 2026-04-22 11:34:04,010 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: Failed to start server in (nonserver) m… --- ## [Looking for advice on Keycloak token storage strategy](https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337)
**Author:** [@nickp](https://forum.keycloak.org/u/nickp)\ **Replies:** 0\ **Last updated:** [April 21, 2026, 9:50am UTC](https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337 "2026-04-21T09:50:44Z")
Hello everyone, I’m trying to figure out the right token handling approach for Keycloak + Next.js + FastAPI. This is not a pure SPA, and in the main flow, requests to FastAPI are mostly made server-side. Because of th… --- ## [Existing users with same username as ldap fails to import](https://forum.keycloak.org/t/existing-users-with-same-username-as-ldap-fails-to-import/31333)
**Author:** [@Shubham](https://forum.keycloak.org/u/Shubham)\ **Replies:** 0\ **Last updated:** [April 15, 2026, 1:02pm UTC](https://forum.keycloak.org/t/existing-users-with-same-username-as-ldap-fails-to-import/31333 "2026-04-15T13:02:23Z")
I am trying to solve a problem i am stuck at. I have incremental users in hr application i am planning to import as soon as the user gets added and allow him to login using created password on temporary basis but this u… --- ## [Keycloak Radius Plugin](https://forum.keycloak.org/t/keycloak-radius-plugin/29725)
**Author:** [@omotayio](https://forum.keycloak.org/u/omotayio)\ **Replies:** 4\ **Last updated:** [April 14, 2026, 8:26am UTC](https://forum.keycloak.org/t/keycloak-radius-plugin/29725 "2026-04-14T08:26:42Z")
Hi, I am currently running keycloak 24.0 and need to install and setup the radius plugin. I am not able to locate a radius plugin for this version with concrete installation instruction. Has anyone setup radius on keyc… --- ## [Intermitten auth issue with keycloak v26](https://forum.keycloak.org/t/intermitten-auth-issue-with-keycloak-v26/31332)
**Author:** [@denis1](https://forum.keycloak.org/u/denis1)\ **Replies:** 0\ **Last updated:** [April 13, 2026, 11:39am UTC](https://forum.keycloak.org/t/intermitten-auth-issue-with-keycloak-v26/31332 "2026-04-13T11:39:42Z")
Hi all, I have keycloak v26 running on a single pod, behind nginx. When I login to my app, it authenticates user’s jwt token. At first try, after I write my email and click login button it returns 401 page (“failed to e… --- ## [How to enable Direct Naked Impersonation in last version 26.5.6](https://forum.keycloak.org/t/how-to-enable-direct-naked-impersonation-in-last-version-26-5-6/31313)
**Author:** [@ivanleone711-sys](https://forum.keycloak.org/u/ivanleone711-sys)\ **Replies:** 4\ **Last updated:** [April 10, 2026, 4:52pm UTC](https://forum.keycloak.org/t/how-to-enable-direct-naked-impersonation-in-last-version-26-5-6/31313 "2026-04-10T16:52:33Z")
Hi everyone, I am trying to use the Direct Naked Impersonation feature in Keycloak version 26.5.6, but I am running into some issues and I’m not able to follow the steps described in the official documentation. In part… [Previous page](https://forum.keycloak.org/latest.md) [Next page](https://forum.keycloak.org/latest.md?page=2)