Enabling and disabling features
Keycloak has packed some functionality in features, including some disabled features, such as Technology Preview and deprecated features. Other features are enabled by default, but you can disable them if they do not apply to your use of Keycloak.
Enabling features
Some supported features, and all preview features, are disabled by default. To enable a feature, enter this command:
bin/kc.[sh|bat] build --features=<name>[,<name>]For example, to enable docker and token-exchange, enter this command:
bin/kc.[sh|bat] build --features=docker,token-exchangeTo enable all preview features, enter this command:
bin/kc.[sh|bat] build --features=previewDisabling features
To disable a feature that is enabled by default, enter this command:
bin/kc.[sh|bat] build --features-disabled=<name>[,<name>]For example to disable impersonation, enter this command:
bin/kc.[sh|bat] build --features-disabled=impersonationYou can disable all default features by entering this command:
bin/kc.[sh|bat] build --features-disabled=defaultThis command can be used in combination with features to explicitly set what features should be available.
If a feature is added both to the features-disabled list and the features list, it will be enabled.
Supported features
The following list contains supported features that are enabled by default, and can be disabled if not needed.
account-api |
Account Management REST API |
account2 |
New Account Management Console |
admin-api |
Admin API |
admin2 |
New Admin Console |
authorization |
Authorization Service |
ciba |
OpenID Connect Client Initiated Backchannel Authentication (CIBA) |
client-policies |
Client configuration policies |
impersonation |
Ability for admins to impersonate users |
par |
OAuth 2.0 Pushed Authorization Requests (PAR) |
step-up-authentication |
Step-up Authentication |
web-authn |
W3C Web Authentication (WebAuthn) |
Preview features
Preview features are disabled by default and are not recommended for use in production. These features may change or be removed at a future release.
admin-fine-grained-authz |
Fine-Grained Admin Permissions |
client-secret-rotation |
Client Secret Rotation |
declarative-user-profile |
Configure user profiles using a declarative style |
openshift-integration |
Extension to enable securing OpenShift |
recovery-codes |
Recovery codes |
scripts |
Write custom authenticators using JavaScript |
token-exchange |
Token Exchange Service |
update-email |
Update Email Action |