Fixed in main, not merged to 2026Q4: Keycloak -- multiple vulnerabilities
Identity and access management solution
# pkg install keycloakinstalls 26.8.1 from latest; from quarterly (2026Q4) 26.8.0# cd /usr/ports/net/keycloak && make install clean# make -C /usr/ports/net/keycloak config # change options first
keycloak, group keycloakKeycloak was installed
1) Configuration files are located at /usr/local/share/java/keycloak/conf
2) keycloak start in production mode by default. https is mandatory in this
mode. You must generate some certificate files.
# cd /usr/local/share/java/keycloak/conf
# openssl req -newkey rsa:2048 -nodes -keyout server.key.pem -x509 \
-days 3650 -out server.crt.pem
# chmod 640 server.crt.pem server.key.pem
# chown keycloak:keycloak server.crt.pem server.key.pem
Do not forget set certificate paths into keycloak.conf
3) If you want start keycloak on develpment mode (http), you can change
it the following way:
# sysrc keycloak_flags=start-dev
4) Also you can use mysql or postgresql backend for store keycloak data. Take a
look at db, db-username, db-password and db-url options into keycloak.conf
file.
5) Enable keycloak service
# service keycloak enable
6) Sometimes you will need run a keycloak build when you change some settings
into config file or when you pass from development mode to production mode.
Try the following if you need it:
# service keycloak build
7) Start keycloak service
# service keycloak start
8) Development mode listen on 8080 port and production mode listen on 8443 port
by default. Depending of your own configuration, the administration console
can be accesing from a web browser from localhost first time:
http://localhost:8080
or if you are using production mode
https://ip_or_hostname:8443
9) Also, you can create admin user by using KEYCLOAK_ADMIN and
KEYCLOAK_ADMIN_PASSWORD environment variables when keycloak is started first
time on production mode:
# cd /usr/local/etc/rc.d
# KEYCLOAK_ADMIN=admin_user KEYCLOAK_ADMIN_PASSWORD=pass_user sh keycloak start
10) For more information about keycloak configuration, visit:
https://www.keycloak.org/documentation
11) Enjoy it| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 26.8.1 | 26.8.0 | – |
| FreeBSD 15 | 26.8.1 | 26.8.0 | – |
| FreeBSD 14 | 26.8.0 | 26.8.0 | 26.8.0 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 26.8.0 | 26.8.0 | – |
| FreeBSD 14 | 26.8.0 | 26.8.0 | 26.8.1 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 26.8.1.CVE-2026-101333, CVE-2026-103884, CVE-2026-107121, CVE-2026-15943, CVE-2026-18569, CVE-2026-82968, CVE-2026-94000, CVE-2026-94001, CVE-2026-94213, CVE-2026-94215, CVE-2026-94217, CVE-2026-94218, CVE-2026-95503, CVE-2026-96445, CVE-2026-96446, CVE-2026-97177, CVE-2026-97311, CVE-2026-97846
CVE-2026-12388, CVE-2026-14781, CVE-2026-19608, CVE-2026-54515, CVE-2026-59889, CVE-2026-59903
CVE-2026-16072, CVE-2026-16089, CVE-2026-16093, CVE-2026-16104, CVE-2026-16105, CVE-2026-16106, CVE-2026-16108, CVE-2026-17059, CVE-2026-18201, CVE-2026-18209, CVE-2026-18214, CVE-2026-18215, CVE-2026-18218, CVE-2026-18570, CVE-2026-18571, CVE-2026-18572, CVE-2026-18573, CVE-2026-19729, CVE-2026-35563, CVE-2026-79652
CVE-2026-14209, CVE-2026-14614, CVE-2026-14615, CVE-2026-4629, CVE-2026-9793
CVE-2021-10039, CVE-2021-10270, CVE-2021-10451, CVE-2021-10492, CVE-2021-9666
net/keycloak: Update to 22.0.3.b4fb85cb04
net/keycloak: Update to 21.1.1 PR: 271207 Approved by: Matthias Wolf <freebsd@rheinwolf.de> (maintainer)4bc816591d
net/keycloak: Update to 20.0.5 ChangeLog: https://www.keycloak.org/2023/02/keycloak-2005-released.html Bugs: * Fine-grained authorization behavior for management of groups differs between version 18.0.3 and 19.03, 20.0 keycloak-ui section/other * Not able to see the events UI keycloak-ui section/events * Keycloak 20.0.2-1 OutOfMemoryError in admin ui keycloak-ui section/clients * SAML client import cert pem file for "Encryption keys config" broken keycloak-ui section/clients * Default value of `NameID policy format` is not correct in SAML Identity Provider keycloak-ui section/identity providers * Escape character in SAML response keycloak saml * OfflineSessionPersistenceTest times out with session preloading keycloak storage PR: 269736 Reported by: freebsd@rheinwolf.de (maintainer) MFH: 2023Q1 (bugfix release)a9555f688e
net/keycloak: Update to 20.0.3 ChangeLog: https://www.keycloak.org/2023/01/keycloak-2003-released.html * User role mapping tab: Show effective client roles for a user keycloak-ui section/users * ProviderConfigProperty.MAP_TYPE error in new UI keycloak-ui section/identity providers * Unable to turn on "Bypass identity confirmation" keycloak-ui section/authentication * Adding Form sub-flow broken on admin v2 keycloak-ui section/authentication * Custom User Provider SPI: There are no settings to configure the periodically synchronization of users keycloak-ui section/user federation * Assign roles to account - paging doesn't work keycloak-ui section/users * Realm selector requires two clicks to select something keycloak-ui section/realms * User management -> User in 2 subgroups with the same group name assignment does not work keycloak-ui section/users * Invalid language tag error when changing realm localization settings keycloak-ui section/realm settings * `Missing ":type" param` in the Events page when there are Client Scope events keycloak-ui section/events * Import client broken keycloak-ui section/clients * New Admin Console only, unable to add client profile in the first client policy keycloak-ui section/realm settings * Disabling hostname strict in prod doesn't disable https keycloak dist/quarkus * snakeyaml vulnerability GHSA-3mc7-4q67-w48m impacting CLI keycloak admin/cli * The redirect URI cannot be verified during logout in the case when client was removed keycloak oidc * Wrong auth session id being used when validating auth session id cookies keycloak core * Update XStream to 1.4.20 to fix CVE-2022-40151 & CVE-2022-41966 keycloak * Timeout when executing command PutMapCommand keycloak storage * Set OkHttp to 4.10.0 in parent pom keycloak * Lack of validation of access token on client registrations endpoint keycloak oidc PR: 268939 Reported by: freebsd@rheinwolf.de (maintainer) MFH: 2023Q1 (bugfix, security fixes) Security: CVE-2022-40151, CVE-2022-41966db9a594cc0
net/keycloak: Update to 20.0.2 ChangeLog: https://www.keycloak.org/2022/12/keycloak-2002-released.html Enhancements * Expiration for Admin Events Bugs * KC Operator Test WatchedSecretsTest.testSecretsAreWatched is unstable * Error in Core? ( Clients Client details Dedicated scopes): Cannot read properties of undefined (reading 'helpText') * NPE in theme.getName() via getMainPage * Failed to run scheduled task ClearExpiredAdminEvents Oracle * Flaky test: OpenshiftClientStorageTest.testCodeGrantFlowWithServiceAccountUsingOAuthRedirectReference * SAMLFilterServletAdapterTest fails on Oracle * Internal pipelines don't tests run for OracleDB or other database * clientID are base64 encoded in state uri param with non URI friendly base64 PR: 268369 Reported by: freebsd@rheinwolf.de (maintainer)08250c7379
net/keycloak: Update to 20.0.1 ChangeLog: https://www.keycloak.org/2022/11/keycloak-2001-released.html PR: 2676375119d71f54
net/keycloak: Update to 19.0.3 ChangeLog: https://www.keycloak.org/2022/10/keycloak-1903-released.html * AdminV2 not using admin hostname keycloak-ui admin/ui * Clear expired events errors keycloak storage * CryptoIntegration fails to init on WebSphere Liberty keycloak * keycloak 19 legacy: unable to deploy war-packaged user storage provider keycloak storage * Missing variable declaration in AuthZ JS keycloak adapter/javascript * Browser-based flows not working properly due to 3rd party cookie policies on Firefox PR: 266939 Reported by: freebsd@rheinwolf.de (maintainer)b82ed46853
net/keycloak: Reduce pkg-plist future updates impact - Use PLIST_SUB to reduce pkg-plist changes on future updates - Not bumping PORTREVISION Reported by: osa428b1f2cd5
net/keycloak: Update to 19.0.2 ChangeLog: https://github.com/keycloak/keycloak/compare/19.0.1...19.0.2 PR: 266513bb1ff50154
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
net/keycloak: Upgrade to 19.0.1 ChangeLog: https://www.keycloak.org/2022/07/keycloak-1901-released PR: 265072 Reported by: yonas.yanfa@gmail.com (maintainer)6ea017569f
Fix CONFLICTS entries of multiple ports There have been lots of missing CONFLICTS_INSTALL entries, either because conflicting ports were added without updating existing ports, due to name changes of generated packages, due to mis-understanding the format and semantics of the conflicts entries, or just due to typoes in package names. This patch is the result of a comparison of all files contained in the official packages with each other. This comparison was based on packages built with default options and may therefore have missed further conflicts with optionally installed files. Where possible, version numbers in conflicts entries have been generalized, some times taking advantage of the fact that a port cannot conflict with itself (due to logic in bsd.port.mk that supresses the pattern match result in that case). A few ports that set the conflicts variables depending on complex conditions (e.g. port options), have been left unmodified, despite probably containing outdated package names. These changes should only affect the installation of locally built ports, not the package building with poudriere. They should give an early indication of the install conflict in cases where currently the pkg command aborts an installation when it detects that an existing file would be overwritten, Approved by: portmgr (implicit)bcaf25a8c8
net/keycloak: Update to 15.1.1 https://www.keycloak.org/2021/12/keycloak-1510-released.html PR: 26047022abec8a83
net/keycloak: Add CPE information Approved by: portmgr (blanket)6dcc123d5b
net/keycloak: update to 15.0.2. PR: 257974 Reported by: maintainerde8eff3e42
net/keycloak: Update to 15.0.1 Changelog: https://www.keycloak.org/docs/latest/release_notes/index.html#keycloak-15-0-1 PR: 25788378adc5de70
net/keycloak: Update to 14.0.0 PR: 256747 Approved by: lwhsu (mentor, implicit)5983e7c1d8
net/keycloak: Update to 13.0.1 PR: 256168 Submitted by: Matthias Wolf <freebsd@rheinwolf.de> (maintainer) Approved by: lwhsu (mentor, implicit)11e7a6ec5a
net/keycloak: Update to 13.0.0 ChangeLog: https://www.keycloak.org/2021/05/keycloak-1300-released.html While here pet linters PR: 255744 Reported by: freebsd@rheinwolf.de (maintainer)cb5002435d
One more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
all: Remove all other $FreeBSD keywords.135fdeebb9
Remove # $FreeBSD$ from Makefiles.305f148f48
net/keycloak: Update to 12.0.4 Changes: https://issues.jboss.org/issues/?jql=project%20%3D%20keycloak%20and%20fixVersion%20%3D%2012.0.4 PR: 253955 Submitted by: Matthias Wolf <freebsd AT rheinwolf DOT de> (maintainer)3c85120f5d
net/keycloak: Update to 12.0.3 ChangeLog: https://issues.jboss.org/issues/?jql=project%20%3D%20keycloak%20and%20fixVersion%20%3D%2012.0.3 PR: 253694 Submitted by: freebsd@rheinwolf.de (maintainer)b9edc6b878
Add keycloak 12.0.2, identity and access management solution. PR: 252831 Submitted by: freebsd@rheinwolf.deb4fe893899