Skip to content

1.0.0

Choose a tag to compare

View all tags
@mabartos mabartos released this 10 Apr 09:29
· 46 commits to main since this release
1.0.0
3fe5a09

🚀 Keycloak Adaptive Authentication — 1.0.0 🚀

The first major release of Keycloak Adaptive Authentication — a more production-ready approach, an extensible framework for risk-based and adaptive authentication in Keycloak.

✨ Highlights

  • 🎲 Log-Odds (Bayesian Evidence) risk scoring algorithm — a probabilistic algorithm that produces calibrated risk probabilities, replacing the previous point-based system
  • ⚡ Virtual Threads risk engine — concurrent risk evaluation using Java virtual threads
  • 🤖 AI integrations — Anthropic Claude, Google Gemini, OpenAI ChatGPT, with automatic data anonymization before sending to any external service
  • 🔗 Chained User contexts — declarative approach to get more information about the user/device - get the information, but do not care how
  • 🔒 Fallback risk levels — configurable fallback when the risk engine fails to evaluate, preventing users from bypassing additional authentication
  • 🧪 More comprehensive testing
  • 📦 Keycloak 26.5.x / 26.6.x support

⚙️ Risk Engine

  • Implement Log-Odds (Bayesian Evidence) algorithm as a new risk score computation method (LogOddsRiskAlgorithm)
  • Make risk score algorithm configurable at the realm level, with Log-Odds as the default
  • Implement Virtual Threads risk engine with concurrent evaluator execution (now the default)
  • Add OpenTelemetry tracing support for the Virtual Threads risk engine
  • Compute the overall risk score based on the selected algorithm
  • Introduce ResultRisk and ability to map Risk scores to a point system
  • Add configurable fallback risk levels (simple and advanced) for when the risk engine fails to evaluate
  • Rename weight to trust across the risk evaluation API

🔍 Risk Evaluators

🆕 New Evaluators

  • LoginFailuresRiskEvaluator — comprehensive login failure pattern analysis using LOGIN_ERROR events from the event store (replaces dependency on the brute force detector)
  • KnownLocationRiskEvaluator — evaluates risk based on known vs. unknown login locations (country/city)
  • TimePatternRiskEvaluator — uses circular statistics + EWMA to track and evaluate typical login times
  • ConcurrentSessionRiskEvaluator — detects concurrent sessions and distinct IPs during continuous evaluation
  • ClientSensitivityRiskEvaluator — risk scoring based on client role and client sensitivity level
  • DefaultUserRoleEvaluator — extends realm roles checking
  • AiAccountTakeoverEvaluator — AI-powered detection of potential account takeover

🗑️ Removed Evaluators

  • Removed AiTimeAccessRiskEvaluator, AiLoginFailuresRiskEvaluator, AiDeviceRiskEvaluator — replaced by more accurate local evaluators that don't depend on external AI calls

👤 User Contexts

  • KnownLocationContext — track last known login locations per user
  • TypicalAccessTimeContext — evaluate and store typical access time patterns
  • OnSuccessfulLoginCallback — callback mechanism applied to TypicalAccessTime context
  • Chained User Context — ability to compose and chain multiple user contexts
  • User context subtypes — specify subtype of user context for finer granularity
  • Location condition — conditional authenticator based on location check
  • Cache location in the authentication session and global cache using Caffeine
  • Remove the external IP address dependency, keep minimal version in the project

🖥️ Admin Console UI

  • Client risk-based policies tab — configurable additional risk sensitivity for clients - some clients are more critical than the others
  • Uses Keycloak's declarative UI (declarative-ui:v1 experimental feature)
  • Custom theme separated from classpath for easier deployment

🤖 AI Integration

  • OpenAI ChatGPT integration
  • Anthropic Claude integration (default model: claude-haiku-4-5-20251001)
  • Google Gemini integration (default model: gemini-2.5-flash-lite, free tier available)
  • Data anonymization — all user data (IP addresses, device info) is automatically anonymized before being sent to AI services
  • IBM Granite deprecated
  • AI prompts now return Risk.Score enum values instead of raw doubles

🙏 Contributors

Thank you to everyone who contributed to making this first major release possible! 🎉

Upgrading guide: https://github.com/mabartos/keycloak-adaptive-authn/wiki/Upgrading-guide-0.4.8-%E2%80%90--1.0.0
Full Changelog: 0.4.8...1.0.0

Assets 9
Loading
0 Join discussion