datakollektivet/systemer
Watch
13
0
Fork
You've already forked systemer
 0
Code Issues 3 Pull requests 7 Projects Releases Packages Wiki Activity Actions

Upgrade keycloak to 26.7.2 #72

Open
luisa wants to merge 2 commits from keycloak-update into main
pull from: keycloak-update
merge into: datakollektivet:main
Conversation 1 Commits 2 Files changed 4 +5 -3
luisa commented 2026-08-28 18:40:08 +00:00
Member
Copy link

I went through the migration notes provided by Keycloak for all versions since 26.6.2 up to 26.7.2.

A breaking change is mentioned with respect to reverse proxies that I honestly don't understand: https://www.keycloak.org/docs/latest/upgrading/index.html#x509-client-authentication-requires-ca-subject-dn
Otherwise, it looked okay. Local test showed persistence of user data and config (via terraform plan).

One notable change is that users only select their password after verifying their email address after registration. It is possible to restore the old behaviour, but I have chosen not to do so. I have tested the new flow.

I went through the [migration notes](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-3) provided by Keycloak for all versions since 26.6.2 up to 26.7.2. A breaking change is mentioned with respect to reverse proxies that I honestly don't understand: https://www.keycloak.org/docs/latest/upgrading/index.html#x509-client-authentication-requires-ca-subject-dn Otherwise, it looked okay. Local test showed persistence of user data and config (via `terraform plan`). One notable change is that users only select their password after verifying their email address after registration. It is possible to restore the old behaviour, but I have chosen not to do so. I have tested the new flow.
gingermusketeer approved these changes 2026-08-28 19:39:09 +00:00
gingermusketeer left a comment
Copy link

Looks good!

The X509 Client certificates are not something we are using. It allows a client such as Loomio to use a certificate to authenticate rather than using a client ID/secret which is what we will need to use.

Looks good! The X509 Client certificates are not something we are using. It allows a client such as Loomio to use a certificate to authenticate rather than using a client ID/secret which is what we will need to use.
This pull request has changes conflicting with the target branch.
  • auth/README.md
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin keycloak-update:keycloak-update
git switch keycloak-update
Sign in to join this conversation.
Reviewers
No reviewers
gingermusketeer
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
datakollektivet/systemer!72
No description provided.