Keycloak was installed
1) Configuration files are located at /usr/local/share/java/keycloak/conf
2) keycloak start in production mode by default. https is mandatory in this
mode. You must generate some certificate files.
# cd /usr/local/share/java/keycloak/conf
# openssl req -newkey rsa:2048 -nodes -keyout server.key.pem -x509 \
-days 3650 -out server.crt.pem
# chmod 640 server.crt.pem server.key.pem
# chown keycloak:keycloak server.crt.pem server.key.pem
Do not forget set certificate paths into keycloak.conf
3) If you want start keycloak on develpment mode (http), you can change
it the following way:
# sysrc keycloak_flags=start-dev
4) Also you can use mysql or postgresql backend for store keycloak data. Take a
look at db, db-username, db-password and db-url options into keycloak.conf
file.
5) Enable keycloak service
# service keycloak enable
6) Sometimes you will need run a keycloak build when you change some settings
into config file or when you pass from development mode to production mode.
Try the following if you need it:
# service keycloak build
7) Start keycloak service
# service keycloak start
8) Development mode listen on 8080 port and production mode listen on 8443 port
by default. Depending of your own configuration, the administration console
can be accesing from a web browser from localhost first time:
http://localhost:8080
or if you are using production mode
https://ip_or_hostname:8443
9) Also, you can create admin user by using KEYCLOAK_ADMIN and
KEYCLOAK_ADMIN_PASSWORD environment variables when keycloak is started first
time on production mode:
# cd /usr/local/etc/rc.d
# KEYCLOAK_ADMIN=admin_user KEYCLOAK_ADMIN_PASSWORD=pass_user sh keycloak start
10) For more information about keycloak configuration, visit:
https://www.keycloak.org/documentation
11) Enjoy it
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
26.8.1
26.8.0
–
FreeBSD 15
26.8.1
26.8.0
–
FreeBSD 14
26.8.0
26.8.0
26.8.0
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
26.8.0
26.8.0
–
FreeBSD 14
26.8.0
26.8.0
26.8.1
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 26.8.1.
Fixed (8)
Show 8 fixed
VuXML entries whose affected range the packaged version has left.
net/keycloak: Fix runtime for Java 25+, improve port
Add to JAVA_ADD_OPENS in kc.sh for run with Java 25+:
--add-opens=java.base/java.lang=ALL-UNNAMED
--enable-native-access=ALL-UNNAMED
The patch was obtained from here:
https://github.com/keycloak/keycloak/pull/45872/files#diff-28d941fe33e0f8217892e8096ba7152ba9ade67e3b2c3f0ce31a333d90cc339d
For more information read:
https://github.com/keycloak/keycloak/issues/43265
https://github.com/keycloak/keycloak/pull/45872
Improve port:
- Parametrize "keycloak" with "${PORTNAME}" in USE_RC_SUBR.
- Replace "RM *.bat" with "EXTRACT_AFTER_ARGS=--exclude *.bat".
- Remove unnecessary "+" in "SUB_FILES+=" and "SUB_LIST+=".
- Use declared "KEYCLOAK_GROUP" instead of "USERS" in "GROUPS"
assignment.
- Use "RLN" instad of "LN -sf".
- Move the creation of "*.sample" configuration files from
"post-patch" to "do-install".
- Improve alignment in comments rc script.
- Respect "%%USER%%" and "%%GROUP%%" in rc script.
- Replace "export JAVA_HOME=…" with "${name}_env=JAVA_HOME=…" in rc
script.
PR: 294235
Approved by: Matthias Wolf <freebsd@rheinwolf.de> (maintainer)
Sponsored by: UNIS Labs
MFH: 2026Q2
Mk/**java.mk: Convert bsd.java.mk to USES
The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
USES=java:build,run if NO_BUILD is undefined. Else it defaults to
USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>
Approved by: mat (portmgr), glewis
Differential Revision: https://reviews.freebsd.org/D48201
net/keycloak: Update 25.0.5 → 25.0.6 (fix CVE-2024-8698 CVE-2024-8883)
Changelog:
https://www.keycloak.org/2024/09/keycloak-2506-released.html
CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open
Redirect
CVE-2024-8698 Improper Verification of SAML Responses Leading to
Privilege Escalation in Keycloak
PR: 281602
MFH: 2024Q3
net/keycloak: Update to 24.0.4
ChangeLog: https://www.keycloak.org/2024/05/keycloak-2404-released.html
Enhancements
#27508 Use new remote-store options in HA guides
#28429 Add details to error messages, especially around refresh tokens
#28729 Emphasize the need for setting container limit docs
#28880 Upgrade to Quarkus 3.8.4 dist/quarkus
#29183 Minor corrections to High Availability Guide docs
Bugs
#16345 Unable to delete realm names with invalid URL characters admin/api
#22617 kc export fails when using User Federation (LDAP) with file-based Vault
enabled import-export
#24568 iframe for frontend logout gets blocked if a custom CSP header is used
core
#24878 NoClassDefFoundError for Apache XML and EAP8 adapter/jee-saml
#27021 Workflow failure: Fuse adapter tests ci
#27080 Workflow failure: Operator CI -
KeycloakTruststoresTests#testTrustroreExists ci
#27514 Uncaught server error: java.lang.IllegalArgumentException: Path
parameter not provided oidc
#28079 Group search does not work in user view admin/ui
#28187 Admin UI drag & drop in flow config seems to delete actions admin/ui
#28220 Admin API: User PUT operation clears firstname, lastname email fields
admin/api
#28303 WARN - Event object wasn't available in remote cache after event was
received infinispan
#28377 Broken lists in import/export server guide docs
#28431 Dedicated client scopes always show up when searching admin/ui
#28514 Message for searchClientRegistration is missing admin/ui
#28666 Accessing a transient (lightweight) user through client session fails in
admin-api/-ui admin/ui
#28684 "Extend to children" button in authorization group policies is wrongly
disabled admin/ui
#28911 clients_saml_test.spec.ts fails in main admin/ui
#29072 Startup probe should check for existence of an Admin user before
returning 200 dist/quarkus
#29094 Fix the client name help grammatical error admin/ui
#29133 DuplicateEmailValidator causes two DB queries on every login if a user
has an email address core
#29147 local user login not possible after LDAP connection problem ldap
#29154 Update docs to distinguish between product names and CR names docs
#29233 Broken link in documentation docs
PR: 278856
Reported by: freebsd@rheinwolf.de (maintainer)
net/keycloak: update to 23.0.6
- Update to 23.0.6
- Add keycloak user and group
- Add pkg-message
- Add support for development(start-dev) and production (start) mode at rc script
- Export JAVA_HOME from rc script
- Add keycloak build function into rc script
PR: 275658 276859
Approved by: maintainer timeout (2 weeks)
net/keycloak: Update to 23.0.5
ChangeLog: https://www.keycloak.org/2024/01/keycloak-2305-released.html
New features
* Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x
* Remove conditional statements about Windows / Linux from the docs docs
Enhancements
* Role mapping tab no longer visible when using fine grained permissions after
upgrade from 20.0.3 to 21.0.2 admin/ui
* Clarification needed of use of containers
* Change RHDG references to Infinispan
* Don't differentiate Windows for getting started docs
* Update to Quarkus 3.2.10
Bugs
* Multiple failures in OfflineServletsAdapterTest (testServlet,
testServletWithConsent, testServletWithRevoke) testsuite
* admin-fine-grained-authz + client authorization settings requires view-client
role admin/ui
* Read Only Access of a realm clients' Authz is broken for Admin Console
admin/ui
* User details tab does not display or update attibutes with dot admin/ui
* Read Only Access of the realm users' "Role mapping" tab is broken for Admin
Console admin/ui
* Log Injection during WebAuthn authentication/registration authentication
* Admin Console: Realm Dropdown should only show the realms the user has access
to admin/ui
* Account v3 theme - theme.properties Custom theme scripts not loading
account/ui
* Removing all group attributes no longer works with keycloak-admin-client
(java) admin/client-java
* `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user
doesn't have access to see admin/ui
* Flaky test:
org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet
ci
* Since 23, start-dev command line arguments parsing is buggy dist/quarkus
* admin ui uses hyphen instead of dot as realm attribute separator admin/ui
* Keycloak HA Guide uses token for cross-site setup that expires
* GitHub Status check is green if the build fails ci
* Workflow failure: FIPS IT -
KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode ci
PR: 276706
Reported by: freebsd@rheinwolf.de (maintainer)