{
 "slug": "keycloak",
 "name": "Keycloak",
 "tagline": "Identity and access management with OIDC, OAuth 2.0, SAML and single sign-on",
 "category": "security-identity",
 "use_cases": [
  "sso",
  "oidc",
  "identity-provider"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Keycloak",
  "url": "https://www.keycloak.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/keycloak/keycloak/blob/main/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "26.8.1",
   "last_build": "2026-10-23",
   "entity_id": "prod-cvh5rpn22va6w",
   "ami_alias": "/aws/service/marketplace/prod-cvh5rpn22va6w/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-bh2keitjhzbma",
   "recommended_instance_type": "m6i.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "26.8.0",
   "last_build": "2026-10-05",
   "offer_id": "keycloak",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:keycloak:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.keycloak?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/keycloak/",
  "json": "https://lynxroute.com/products/keycloak/product.json"
 },
 "release_notes": [
  {
   "version": "26.8.1",
   "title": "Keycloak 26.8.1",
   "notes": "* Keycloak updated 26.8.0 -> 26.8.1, a security release. Apache-2.0 unchanged\n* Security: about 20 CVEs fixed, including fine-grained admin permission escalation (CVE-2026-94000, CVE-2026-94001, CVE-2026-97177), a two-factor authentication bypass (CVE-2026-94218), cross-realm access (CVE-2026-94215), an SMTP StartTLS downgrade (CVE-2026-107121) and a CRL path traversal (CVE-2026-103884)\n* Behaviour changes: SMTP StartTLS is enforced when enabled, backchannel logout signatures are always verified, X.509 CRL paths must live under conf/, and identity-provider secrets must be re-entered when the destination changes\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "26.8.0",
   "title": "Keycloak 26.8.0",
   "notes": "* Keycloak 26.8.0 on Ubuntu 24.04 LTS - feature release (from 26.7.4). Apache-2.0 unchanged\n* Security: identity provider mappers can no longer grant administrative roles unless explicitly allowed (CVE-2026-12388), bare group names in token claims now match only top-level groups (CVE-2026-19608), and disabled clients are no longer added to token audiences (CVE-2026-93999)\n* Security: client secrets are hidden from view-only administrators, and the OIDC broker no longer marks an unverified e-mail as verified (CVE-2026-14781)\n* New: the SCIM API and client secret rotation are now supported and enabled by default, and brute-force login failures are stored in the database so lockouts survive restarts\n* Upgrade note: the initiating_idp logout parameter is now ignored by default, and custom login themes should be re-checked against the redesigned identity provider buttons\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-05"
   }
  },
  {
   "version": "26.7.4",
   "title": "Keycloak 26.7.4",
   "notes": "* Keycloak 26.7.4 on Ubuntu 24.04 LTS - security and bugfix release (from 26.7.3). Apache-2.0 unchanged\n* Security: 6 CVEs fixed. The impersonation role can no longer impersonate a more privileged realm administrator (CVE-2026-17526), a brokered login whose e-mail collides with an existing username can no longer take over and lock that account (CVE-2026-19607), and one-time artifacts can no longer be replayed on MySQL/MariaDB (CVE-2026-90997)\n* Security: unauthenticated locale caching is now bounded against denial of service (CVE-2026-79651), Authorization Services URI matching now normalizes percent-encoded matrix parameters and dot segments (CVE-2026-74909), and SAML redirect DEFLATE no longer leaks native memory (CVE-2026-18212)\n* Note for Authorization Services users: resource URIs that differ only by matrix parameters, dot segments, a trailing slash or query/fragment now match the same resource\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-16",
    "azure": "2026-09-17"
   }
  },
  {
   "version": "26.7.3",
   "title": "Keycloak 26.7.3",
   "notes": "* Keycloak 26.7.3 on Ubuntu 24.04 LTS - security and bugfix release (from 26.7.2). Apache-2.0 unchanged\n* Security: 21 CVEs fixed. In OIDC, authorization codes can no longer be retargeted to another client session (CVE-2026-16089), a required signed-JWT assertion policy can no longer be bypassed with unsigned assertion headers (CVE-2026-16093), redirect_uri parameter injection is now also checked in the URL fragment (CVE-2026-18209), and client not-before revocation is honoured when the realm value is older but nonzero (CVE-2026-18218)\n* Security: fine-grained admin permissions no longer disclose hidden groups, roles or user PII, and no longer allow a delegated administrator to remove privileged child roles or assign unpermitted groups during user creation (CVE-2026-16108, CVE-2026-16105, CVE-2026-16106, CVE-2026-17059, CVE-2026-18571)\n* Security: the LDAP client now verifies that the server certificate matches the intended hostname (CVE-2026-35563), authenticator configuration no longer surfaces raw reCAPTCHA secrets (CVE-2026-16104), and Google and Microsoft external token exchange now honour hosted-domain and tenant restrictions (CVE-2026-18214, CVE-2026-18215)\n* Performance: admin REST API per-request cost no longer grows super-linearly with the number of realms, lightweight access tokens stop resolving every role across every realm on each admin request, and sustained high CPU after an upgrade is resolved\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "26.7.2",
   "title": "Keycloak 26.7.2",
   "notes": "* Keycloak 26.7.2 on Ubuntu 24.04 LTS - security and bugfix release (from 26.7.1). Apache-2.0 unchanged\n* Security: fixes CVE-2026-18963, an unauthenticated account takeover through a reset-credentials flow bypass, and CVE-2026-15571, an account takeover via a predictable account-linking hash\n* Security: fixes CVE-2026-14613 and CVE-2026-15945 in fine-grained admin permissions, and CVE-2026-17048, where the admin REST API leaked vault-resolved rotated client secrets\n* Security: jackson-databind updated to 2.21.5 for CVE-2026-59888 and CVE-2026-59889, and CVE-2026-45292 in the OpenTelemetry Java SDK is resolved\n* Runs on Quarkus 3.33.3.1; fixes an upgrade failure with preview features enabled and a custom realm-level role named admin that could not be updated in non-master realms\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23"
   }
  },
  {
   "version": "26.7.1",
   "title": "Keycloak 26.7.1",
   "notes": "* Production mode (start --optimized) on a bundled local PostgreSQL; the admin password and the database password are generated uniquely per instance at first launch\n* nginx TLS perimeter on port 443; Keycloak HTTP, management/health and PostgreSQL bound to localhost\n* Certbot pre-installed - enable a CA-signed HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-08-12",
    "azure": "2026-08-12"
   }
  }
 ],
 "release_history": [
  {
   "version": "26.8.1",
   "aws": "2026-10-23"
  },
  {
   "version": "26.8.0",
   "aws": "2026-10-02",
   "azure": "2026-10-05"
  },
  {
   "version": "26.7.4",
   "aws": "2026-09-16",
   "azure": "2026-09-17"
  },
  {
   "version": "26.7.3",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "26.7.2",
   "aws": "2026-08-23"
  },
  {
   "version": "26.7.1",
   "aws": "2026-08-12",
   "azure": "2026-08-12"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-cvh5rpn22va6w/latest \\\n  --instance-type m6i.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer keycloak --plan payg-gen2\naz vm create -g my-rg -n keycloak --size Standard_D2s_v3 \\\n  --image lynxroute:keycloak:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Keycloak is an open-source identity and access management (IAM) server built on Java and Quarkus. It gives applications single sign-on and standards-based authentication and authorization through OpenID Connect, OAuth 2.0, and SAML 2.0, plus realm-based multi-tenancy, role-based access control, user federation against LDAP and Active Directory, identity brokering, social login, fine-grained authorization, and a full admin and account console. Applications integrate through the per-realm OIDC discovery document and standard token endpoints, so any compliant OIDC or SAML client works without vendor SDKs. Keycloak requires a production relational database; this image bundles a local PostgreSQL instance and rotates its password at first launch. Apache-2.0 license, no vendor lock-in - the same codebase as the Red Hat build of Keycloak, with no open-core feature gating.",
  "image_adds": "Security hardening:\n* Production mode (kc.sh build, then start --optimized) against a bundled local PostgreSQL - the embedded H2 database, which upstream supports for development only, is not used\n* Random admin password generated at first launch and written to /root/keycloak-credentials.txt (root-only); no password is baked into the image\n* PostgreSQL password also generated per instance at first launch\n* nginx TLS perimeter on port 443 (self-signed certificate; Certbot pre-installed so a CA-signed certificate is one command away)\n* Keycloak HTTP (8080), management and health (9000), and PostgreSQL (5432) all bound to 127.0.0.1 only\n* UFW firewall pre-configured (ports 22, 80 and 443 only; 80 redirects to HTTPS)\n* fail2ban, auditd, AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}