As Keycloak is a mature project with many past releases and an already large community we are asking for multiple exceptions in a single issue rather than opening many independent issues.
Jakarta Interceptors defines a means of interposing on business method invocations and specific events—such as lifecycle events and timeout events—that occur on instances of Jakarta EE components and other managed classes.
Eclipse Enterprise for Java (EE4J) is an open source initiative to create standard APIs, implementations of those APIs, and technology compatibility kits for Java runtimes that enable development, deployment, and management of server-side and cloud-native applications.
GNU General Public License v2.0 w/Classpath exception
GNU Lesser General Public License v2.1 only
MIT No Attribution
Mozilla Public License 2.0
Universal Permissive License v1.0
Code modified?
Code is used in unmodified form
Changes contributed?
No response
Any alternatives?
The majority of dependencies included in this report are transitive dependencies from the Quarkus framework and have no suitable alternatives available, with the exception of the components listed below.
com.mysql:mysql-connector-j and org.mariadb.jdbc:mariadb-java-client could be removed from the distribution, and require users to install these themselves. However, this would have a negative effect on end-users as it introduces an extra step in connect Keycloak to MySQL or MariaDB databases.
org.openjdk.nashorn:nashorn-core could be removed from the distribution, and require users to install themselves. However, this would have a negative effect on end-users as it introduces an extra step in deploying custom JavaScript code.
An extra point to mention with regard to the above is Keycloak is frequently used and deployed by developers and administrators unfamiliar to Java and JAR files, which increases the difficulty of any additional steps of obtaining and deploying additional JAR files.
Integrates with other components?
Keycloak is distributed as a container as well as an archive. In addition there is a separate container distribution for a Kubernetes Operator. For more details see https://www.keycloak.org/downloads.
All binary distributions of Keycloak include a number of third-party libraries; including Java JAR files and client-side JavaScript libraries.
The majority of Java JARs are transitive dependencies from the Quarkus framework that Keycloak is built-on, with the exception of the components listed below.
com.h2database:h2 is a fast in-memory database written in Java that makes it easier to try out Keycloak for evaluation, development, or integration testing.
com.mysql:mysql-connector-j provides the database driver for Keycloak to connect to MySQL databases.
org.mariadb.jdbc:mariadb-java-client provides the database driver for Keycloak to connect to MariaDB databases.
org.openjdk.nashorn:nashorn-core provides a JavaScript engine to enable custom JavaScript code to be deployed to Keycloak.
As Keycloak is a mature project with many past releases and an already large community we are asking for multiple exceptions in a single issue rather than opening many independent issues.
For complete information on third-party libraries included in binary distributions please refer to the third-party licenses report for the latest release.
An additional item we would like to make the CNCF aware of is in previous releases Keycloak included closed source database drivers for Oracle available under Oracle Free Use Terms and Conditions (FUTC). These have been removed from the distribution from 25.0.0 onwards, and require obtaining and installing by the user themselves to connect Keycloak to an Oracle database, but are still present in releases from 17.x to 24.x.
Component details
License name
Code modified?
Code is used in unmodified form
Changes contributed?
No response
Any alternatives?
The majority of dependencies included in this report are transitive dependencies from the Quarkus framework and have no suitable alternatives available, with the exception of the components listed below.
com.mysql:mysql-connector-jandorg.mariadb.jdbc:mariadb-java-clientcould be removed from the distribution, and require users to install these themselves. However, this would have a negative effect on end-users as it introduces an extra step in connect Keycloak to MySQL or MariaDB databases.org.openjdk.nashorn:nashorn-corecould be removed from the distribution, and require users to install themselves. However, this would have a negative effect on end-users as it introduces an extra step in deploying custom JavaScript code.An extra point to mention with regard to the above is Keycloak is frequently used and deployed by developers and administrators unfamiliar to Java and JAR files, which increases the difficulty of any additional steps of obtaining and deploying additional JAR files.
Integrates with other components?
Keycloak is distributed as a container as well as an archive. In addition there is a separate container distribution for a Kubernetes Operator. For more details see https://www.keycloak.org/downloads.
All binary distributions of Keycloak include a number of third-party libraries; including Java JAR files and client-side JavaScript libraries.
The majority of Java JARs are transitive dependencies from the Quarkus framework that Keycloak is built-on, with the exception of the components listed below.
com.h2database:h2is a fast in-memory database written in Java that makes it easier to try out Keycloak for evaluation, development, or integration testing.com.mysql:mysql-connector-jprovides the database driver for Keycloak to connect to MySQL databases.org.mariadb.jdbc:mariadb-java-clientprovides the database driver for Keycloak to connect to MariaDB databases.org.openjdk.nashorn:nashorn-coreprovides a JavaScript engine to enable custom JavaScript code to be deployed to Keycloak.