New major release 1.0.0 🚀

[mabartos]

🚀 Keycloak Adaptive Authentication — 1.0.0 🚀

The first major release of Keycloak Adaptive Authentication — a more production-ready approach, an extensible framework for risk-based and adaptive authentication in Keycloak.

---

✨ Highlights

• 🎲 Log-Odds (Bayesian Evidence) risk scoring algorithm — a probabilistic algorithm that produces calibrated risk probabilities, replacing the previous point-based system
• ⚡ Virtual Threads risk engine — concurrent risk evaluation using Java virtual threads
• 🤖 AI integrations — Anthropic Claude, Google Gemini, OpenAI ChatGPT, with automatic data anonymization before sending to any external service
• 🔗 Chained User contexts — declarative approach to get more information about the user/device - get the information, but do not care how
• 🔒 Fallback risk levels — configurable fallback when the risk engine fails to evaluate, preventing users from bypassing additional authentication
• 🧪 More comprehensive testing
• 📦 Keycloak 26.5.x / 26.6.x support

---

⚙️ Risk Engine

• Implement Log-Odds (Bayesian Evidence) algorithm as a new risk score computation method (LogOddsRiskAlgorithm)
• Make risk score algorithm configurable at the realm level, with Log-Odds as the default
• Implement Virtual Threads risk engine with concurrent evaluator execution (now the default)
• Add OpenTelemetry tracing support for the Virtual Threads risk engine
• Compute the overall risk score based on the selected algorithm
• Introduce ResultRisk and ability to map Risk scores to a point system
• Add configurable fallback risk levels (simple and advanced) for when the risk engine fails to evaluate
• Rename weight to trust across the risk evaluation API

---

🔍 Risk Evaluators

🆕 New Evaluators

• LoginFailuresRiskEvaluator — comprehensive login failure pattern analysis using LOGIN_ERROR events from the event store (replaces dependency on the brute force detector)
• KnownLocationRiskEvaluator — evaluates risk based on known vs. unknown login locations (country/city)
• TimePatternRiskEvaluator — uses circular statistics + EWMA to track and evaluate typical login times
• ConcurrentSessionRiskEvaluator — detects concurrent sessions and distinct IPs during continuous evaluation
• ClientSensitivityRiskEvaluator — risk scoring based on client role and client sensitivity level
• DefaultUserRoleEvaluator — extends realm roles checking
• AiAccountTakeoverEvaluator — AI-powered detection of potential account takeover

🗑️ Removed Evaluators

• Removed AiTimeAccessRiskEvaluator, AiLoginFailuresRiskEvaluator, AiDeviceRiskEvaluator — replaced by more accurate local evaluators that don't depend on external AI calls

---

👤 User Contexts

• KnownLocationContext — track last known login locations per user
• TypicalAccessTimeContext — evaluate and store typical access time patterns
• OnSuccessfulLoginCallback — callback mechanism applied to TypicalAccessTime context
• Chained User Context — ability to compose and chain multiple user contexts
• User context subtypes — specify subtype of user context for finer granularity
• Location condition — conditional authenticator based on location check
• Cache location in the authentication session and global cache using Caffeine
• Remove the external IP address dependency, keep minimal version in the project

---

🖥️ Admin Console UI

• Client risk-based policies tab — configurable additional risk sensitivity for clients - some clients are more critical than the others
• Uses Keycloak's declarative UI (declarative-ui:v1 experimental feature)
• Custom theme separated from classpath for easier deployment

---

🤖 AI Integration

• OpenAI ChatGPT integration
• Anthropic Claude integration (default model: claude-haiku-4-5-20251001)
• Google Gemini integration (default model: gemini-2.5-flash-lite, free tier available)
• Data anonymization — all user data (IP addresses, device info) is automatically anonymized before being sent to AI services
• IBM Granite deprecated
• AI prompts now return Risk.Score enum values instead of raw doubles

---

🙏 Contributors

Thank you to everyone who contributed to making this first major release possible! 🎉

• @abstractj (Bruno Oliveira da Silva) — Create LICENSE.txt #2
• @k0staa (Michal Kostewicz) — Improve development startup (process and instructions) #28, Implement logic for global enable switch #29, Issue-30 Fix exception in ScheduledContinuousRiskEvaluation #31
• @lezhdz98 (Francisco Lezama)
• @sachtouris (Aggelos Sachtouris) — Fix OS and Browser conditions for multi-value configuration parsing #32
• @thomasdelorge (Thomas Delorge) — 🛠️ [Fix] country/city location conditions + add tests #36

---

Full Changelog: 0.4.8...1.0.0

---

This discussion was created from the release 1.0.0.