Highlights
Email OTP can now be offered under "Try Another Way" to users who never enrolled (#147, #50).
Keycloak only lists a credential-based authenticator under "Try Another Way" for users who have a stored credential of that type, whatever its settings. That's why the old Skip setup option ("Treat any user with an email as configured") could never put Email OTP in that list. This release adds a second execution:
| Execution | Who gets a code | Shown under "Try Another Way" |
|---|---|---|
| Email OTP | Users who have enrolled | Only to enrolled users |
| Email OTP (No Enrollment) (new) | Every user with an email address | To every user |
See Authentication Flow Setup for how to choose between them.
Warning
Breaking change: the Skip setup option has been removed. Realms that used it are migrated automatically on the first startup after the upgrade. Check the server log for SkipSetupMigration.
- Skip setup applied to the whole realm. In every realm where it was enabled, every Email OTP execution is switched to Email OTP (No Enrollment), keeping its settings.
- Conditional Email OTP executions can't be switched. They now only ask enrolled users for a code. A
WARNnames each one, only on that first startup. Ask the remaining users to enroll, or redesign the flow around Email OTP (No Enrollment). - A REQUIRED Email OTP (No Enrollment) step blocks users without an email address ("credential setup required"). Skip setup let them log in without an OTP.
- Realms imported while the server is running, for example from an old export, are migrated on the next restart.
Other changes
- Fixed a
NullPointerExceptionin simulation mode when an Email OTP execution's config has no settings. - Enrollment now prefers the settings of the steps users enroll for, so auto-enrol and the email provider settings are applied consistently.
- OTP log lines are now logged under
AbstractEmailAuthenticatorForminstead ofEmailAuthenticatorForm. This only matters if you set log levels for that exact class.
What's Changed
- fix: offer email OTP under "Try Another Way" without enrollment by @ismailza in #160
- Release 26.7.0 by @github-actions[bot] in #161
Full Changelog: v26.6.1...v26.7.0