Backport a newer version of the Keycloak Client API to Quarkus 3.20 LTS

[sberyozkin]

Hi All,

In #48909, an option of backporting a newer version of the Keycloak Client API to Quarkus 3.20 LTS was discussed.

For example, Quarkus 3.20 has <keycloak-client.version>26.0.4</keycloak-client.version> which Keycloak aware extensions such as admin and keycloak authorization API ones use to communicate with Keycloak (version 26.1.3 in LTS).

Now, Keycloak has just released 26.3.1 and an attempt to use it with the keycloak admin client in 3.20 fails because the keycloak client api 26.0.4 version is not aware of some new properties returned by Keycloak 26.3.1.

According to https://www.keycloak.org/2024/10/release-updates, an update to the keycloak client API version 26.0.6 from 26.0.4, required to support Keycloak 26.3.1 is safe - since it is expected to work with all the released Keycloak versions.

However, my answer in #48909 was that it will not be approved because LTS does not give any forward compatibility guarantees, and version bumps may cause side-effects...

I'd like to double check it here, CC @gsmet @geoand @cescoffier.

Thanks

[cescoffier]

Can we have the release notes for the version? It seems to introduce some incompatibilities, but does it still work with older Keycloak?

[sberyozkin]

Hi @cescoffier, release notes are only available AFAIK for the noteworthy or breaking Keycloak server features, there is no content related to one of Keycloak endpoints returning some extra property and thus possibly breaking some older client API application , because Keycloak also releases a matching client API library if necessary...

Here is a summary:

• On 3.20 LTS, an extension like quarkus-keycloak-admin-rest-client can talk to Keycloak 26.1.3, may be 26.2.x and likely to earlier Keycloak versions like 25.x.x, it uses a client API library that enables this access, and the linked Keycloak doc says that the client api library (v 26.0.4 in 3.20 LTS) is guaranteed to work with the currently released Keycloak versions (available at the time of that client API library release).
• Now, Keycloak 26.3.0/26.3.1 is released and it introduces some new properties for some quarkus-keycloak-admin-rest-client responses and the 26.0.6 version of the client API library is released to support such extra properties.
• Keycloak does not guarantee any compatibility with the client API library earlier than 26.0.6 but they guarantee, according to the linked text, that the 26.0.6 client API library must work not only with the latest Keycloak 26.3.x but also with those Keyloak servers that the older 26.0.4 client API library was able to support... The question here, how practically safe such a backport to 3.20 can be, if it can even be possible to backport to LTS such version bumps

[sberyozkin]

This backport is not even needed, as we've got two independent confirmations, one from @SailReal here and one from the Keycloak team, that with the Keycloak client library 26.0.4 that Quarkus 3.20 depends upon, it is expected to work against newer Keycloak 26.3.x... I'll re-open the issue, sorry for the noise/confusion if any