live wire
▸Red Hat ships important MicroShift 4.16.73 security updateRed Hat Product Errata▸AI · Red Hat maps local AI Inference serving and load tests on RHEL (Oct. 15)Red Hat Emerging Technologies▸PLATFORM · IBM guide maps Secure Execution VMs onto OpenShift Virtualization for LinuxONEIBM Community▸AI · vLLM maps Nemotron 3.5 Super VL across Hopper, Blackwell and Red Hat DSpark (Oct. 15)vLLM Recipes▸AI · AWS contributes push-based KV transfer to vLLM, reporting 3x better TTFT under loadAWS Machine Learning Blog▸AI · AWS contributes bidirectional KV transfer to vLLM, cutting multi-turn TTFT up to 3.3xAWS Machine Learning Blog▸AI · vLLM Semantic Router adds d3-turbo with box and video-tracking decisionsvLLM Semantic Router▸IDENTITY · Keycloak DevDay 2027 opens call for deep technical talks through Oct. 24Keycloak▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸Red Hat ships important MicroShift 4.16.73 security updateRed Hat Product Errata▸AI · Red Hat maps local AI Inference serving and load tests on RHEL (Oct. 15)Red Hat Emerging Technologies▸PLATFORM · IBM guide maps Secure Execution VMs onto OpenShift Virtualization for LinuxONEIBM Community▸AI · vLLM maps Nemotron 3.5 Super VL across Hopper, Blackwell and Red Hat DSpark (Oct. 15)vLLM Recipes▸AI · AWS contributes push-based KV transfer to vLLM, reporting 3x better TTFT under loadAWS Machine Learning Blog▸AI · AWS contributes bidirectional KV transfer to vLLM, cutting multi-turn TTFT up to 3.3xAWS Machine Learning Blog▸AI · vLLM Semantic Router adds d3-turbo with box and video-tracking decisionsvLLM Semantic Router▸IDENTITY · Keycloak DevDay 2027 opens call for deep technical talks through Oct. 24Keycloak▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security
upstreambeat.ai
releaseIDENTITY

Keycloak 26.8 supports SCIM and stateless multi-cluster deployments

The release also promotes client secret rotation, adds consent-based delegation for agents, and deprecates the older multi-site architecture.

Old multi-site versus new stateless Keycloak deployment.
Side by side: what changed
By The Release Desk· Oct 1, 2026the quick take — two AI hosts go live when you do

Keycloak 26.8 promotes three operational capabilities to supported status: its SCIM API, client secret rotation, and the stateless multi-cluster architecture. The release also introduces preview support for consent-based client delegation aimed at AI agents and automation.

What changed

The SCIM API now provides supported standards-based user and group management, including multivalued attributes, user-profile permissions, fine-grained administration checks in searches, and performance work for large user bases.

Multi-cluster v2 is also supported. It stores session data in the database and connects clusters without an external Infinispan deployment. The older multi-cluster v1 multi-site feature is now deprecated; Keycloak recommends migrating to the stateless feature.

Client secret rotation moves from preview to supported status and can retain two active secrets during a planned rollover. Separately, parameterized scopes and token-exchange delegation are now preview features, allowing a user to authorize a client to act on their behalf while recording the client in the token’s act claim.

Who it affects

Identity teams running cross-site Keycloak, provisioning users through external identity systems, or coordinating zero-downtime secret rotation gain supported paths. Operators using --features=multi-site now have a stated replacement and a future removal to plan around.

What to do

Before upgrading, review the 26.8 migration guide. Multi-site operators should test the stateless architecture and its database-backed session behavior. Teams enabling delegation should treat it as preview, define Fine-Grained Admin Permissions, and validate downstream handling of actor claims.

sources

Filed by The Release Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk