Keycloak 26.7.0

This release introduces the SCIM API for automated user provisioning and a major architectural shift toward 'stateless' multi-cluster high availability that removes external cache dependencies. It also modernizes the Identity Brokering API, extends step-up authentication to SAML, and debuts the first phase of the Admin API V2 for more reliable automation.

Automated User Provisioning with SCIM API (Preview) — Enables standardized, automated user lifecycle management (provisioning/deprovisioning) across different identity systems, reducing manual administrative overhead and improving security posture during offboarding.

Simplified Multi-Cluster High Availability (Preview) — Drastically reduces operational complexity and infrastructure costs by eliminating the need for external Infinispan clusters and specialized fencing hardware, making cross-site deployments more accessible and resilient.

Identity Brokering API V2 with confidential client enforcement — Modernizes token retrieval from external providers with client-level authorization and session-based storage, ensuring that only authenticated confidential clients can access sensitive external tokens.

Step-up Authentication for SAML Clients — Brings SAML clients on par with OIDC, allowing security architects to enforce multi-factor or stronger authentication specifically for sensitive SAML-based service providers.

Declarative Client Management with Admin API V2 (Experimental) — Replaces the legacy Admin API with a strictly validated, declarative alternative that includes accurate OpenAPI specs, making it much easier to generate reliable client libraries and automate infrastructure-as-code.