Repository navigation
Upgrade login UI to PatternFly 6 - #52371
Merged
Merged
Conversation
Contributor
Author
|
For testing you can use the theme-preview by running: npx @edewit/theme-preview /path/to/keycloakit will install a provider and the you can see all the pages on http://localhost:8080/realms/master/theme-preview/ |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical and moderate issues include compilation failure, inaccessible authentication flows, broken PF6 theming, and incomplete migration behavior.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Upgrades the default login UI to PatternFly 6 through the new keycloak.v3 theme, with migration support for existing installations and custom themes.
Changes:
- Adds and enables the PatternFly 6 login theme and assets.
- Migrates persisted
keycloak.v2andrh-sso.v2selections. - Updates tooling, Admin UI previews, tests, documentation, and feature declarations.
File summaries
| File | Summary |
|---|---|
themes/src/main/resources/theme/keycloak.v3/login/webauthn-register.ftl |
Adds WebAuthn registration UI. |
themes/src/main/resources/theme/keycloak.v3/login/webauthn-error.ftl |
Critical: Hidden and nested forms make retry/cancel actions inaccessible. |
themes/src/main/resources/theme/keycloak.v3/login/webauthn-authenticate.ftl |
Adds PF6 WebAuthn authentication UI. |
themes/src/main/resources/theme/keycloak.v3/login/user-profile-commons.ftl |
Updates user-profile styling for PF6. |
themes/src/main/resources/theme/keycloak.v3/login/update-email.ftl |
Adds email-update UI. |
themes/src/main/resources/theme/keycloak.v3/login/theme.properties |
Defines PF6 theme classes and assets. |
themes/src/main/resources/theme/keycloak.v3/login/terms.ftl |
Adds terms acceptance UI. |
themes/src/main/resources/theme/keycloak.v3/login/template.ftl |
Migrates the shared login layout to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/social-providers.ftl |
Adds social-provider layout and icons. |
themes/src/main/resources/theme/keycloak.v3/login/select-authenticator.ftl |
Migrates authenticator selection to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/resources/js/userProfile.js |
Moderate: Mutation handling can throw on text nodes or elements without inputs. |
themes/src/main/resources/theme/keycloak.v3/login/resources/js/password-policy.js |
Moderate: ASCII-based \W disagrees with server-side Unicode validation. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/twitter.svg |
Adds Twitter/X icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/twitter-light.svg |
Adds light-variant Twitter/X icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/stackoverflow.svg |
Adds Stack Overflow icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/paypal.svg |
Adds PayPal icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/openshift-v4.svg |
Adds OpenShift icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/microsoft.svg |
Adds Microsoft icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/linkedin-openid-connect.svg |
Adds LinkedIn icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/instagram.svg |
Adds Instagram icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/instagram-light.svg |
Adds light-variant Instagram icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/google.svg |
Adds Google icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/gitlab.svg |
Adds GitLab icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/github.svg |
Adds GitHub icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/github-light.svg |
Adds light-variant GitHub icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/facebook.svg |
Adds Facebook icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/default.svg |
Adds fallback provider icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/default-light.svg |
Adds light-variant fallback icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/social/bitbucket.svg |
Adds Bitbucket icon. |
themes/src/main/resources/theme/keycloak.v3/login/resources/img/keycloak-logo-text.svg |
Adds the Keycloak logo asset. |
themes/src/main/resources/theme/keycloak.v3/login/resources/css/styles.css |
Migrates login styling and tokens to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/register.ftl |
Migrates registration UI to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/register-commons.ftl |
Adds shared registration macros. |
themes/src/main/resources/theme/keycloak.v3/login/qr-code.ftl |
Adds a reusable QR-code macro. |
themes/src/main/resources/theme/keycloak.v3/login/password-validation.ftl |
Adds client-side password feedback. |
themes/src/main/resources/theme/keycloak.v3/login/password-commons.ftl |
Adds shared password-flow controls. |
themes/src/main/resources/theme/keycloak.v3/login/oid4vc-credential-offer.ftl |
Migrates credential-offer UI to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/messages/messages_en.properties |
Updates the English theme description. |
themes/src/main/resources/theme/keycloak.v3/login/login.ftl |
Adds the primary v3 login page. |
themes/src/main/resources/theme/keycloak.v3/login/login-verify-email.ftl |
Adds email-verification UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-username.ftl |
Adds username-first login UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-update-profile.ftl |
Adds profile-update UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-update-password.ftl |
Adds password-update UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-reset-password.ftl |
Adds password-reset UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-recovery-authn-code-input.ftl |
Adds recovery-code input UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-recovery-authn-code-config.ftl |
Migrates recovery-code configuration to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/login-password.ftl |
Adds password-only login UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-passkeys-conditional-authenticate.ftl |
Critical: Unsupported browsers can receive an empty authentication page. |
themes/src/main/resources/theme/keycloak.v3/login/login-otp.ftl |
Adds PF6 OTP login UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-oid4vp.ftl |
Adds OID4VP wallet login UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-oauth2-device-verify-user-code.ftl |
Adds device-code verification UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-oauth-grant.ftl |
Adds OAuth consent UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-idp-link-confirm.ftl |
Adds IdP link confirmation UI. |
themes/src/main/resources/theme/keycloak.v3/login/login-config-totp.ftl |
Migrates TOTP setup to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/link-idp-action.ftl |
Adds the IdP link action page. |
themes/src/main/resources/theme/keycloak.v3/login/footer.ftl |
Adds a customizable footer macro. |
themes/src/main/resources/theme/keycloak.v3/login/field.ftl |
Migrates field controls to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/divider.ftl |
Adds a login divider macro. |
themes/src/main/resources/theme/keycloak.v3/login/delete-credential.ftl |
Adds credential-deletion UI. |
themes/src/main/resources/theme/keycloak.v3/login/delete-account-confirm.ftl |
Migrates account-deletion UI to PF6. |
themes/src/main/resources/theme/keycloak.v3/login/code.ftl |
Adds authorization-code display UI. |
themes/src/main/resources/theme/keycloak.v3/login/buttons.ftl |
Migrates button utilities to PF6. |
themes/src/main/resources/theme/keycloak.v2/login/theme.properties |
Removes the PF5 login theme definition. |
themes/src/main/resources/META-INF/keycloak-themes.json |
Registers keycloak.v3. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_vi.properties |
Updates Vietnamese theme metadata. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_uk.properties |
Updates Ukrainian theme metadata. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_tr.properties |
Adds Turkish v3 theme metadata. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_sv.properties |
Updates Swedish theme metadata. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_pt_BR.properties |
Nit: The corresponding stale v2 resource remains. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_ka.properties |
Updates Georgian theme metadata. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_id.properties |
Updates Indonesian theme metadata. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_de.properties |
Updates German theme metadata 8000 . |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_cs.properties |
Adds Czech v3 theme metadata. |
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_ca.properties |
Updates Catalan theme metadata. |
themes/src/main/resources-community/theme/keycloak.v2/login/messages/messages_tr.properties |
Removes Turkish v2 theme metadata. |
themes/src/main/resources-community/theme/keycloak.v2/login/messages/messages_cs.properties |
Removes Czech v2 theme metadata. |
testsuite/integration-arquillian/tests/pom.xml |
Changes the tested default login theme. |
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/theme/ThemeResourceProviderTest.java |
Updates v3 resource assertions. |
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ThemeSelectorTest.java |
Tests v3 theme selection. |
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractDefaultIdpTest.java |
Updates the PF6 alert locator. |
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java |
Updates the PF6 alert selector. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnErrorPage.java |
Updates the WebAuthn alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/fragments/ContentAlert.java |
Updates PF6 alert fragment locators. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/AbstractLoggedInPage.java |
Updates the PF6 title locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/x509/X509IdentityConfirmationPage.java |
Updates PF6 feedback locators. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyProfilePage.java |
Updates the PF6 alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/RegisterPage.java |
Updates the registration alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PasswordPage.java |
Updates the password alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuth2DeviceVerificationPage.java |
Updates the device-flow alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfilePage.java |
Updates the profile alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginTotpPage.java |
Updates PF6 OTP locators. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordUpdatePage.java |
Updates the password-update alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordResetPage.java |
Moderate: Success-alert locator uses a nonexistent PF6 class. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginConfigTotpPage.java |
Updates the TOTP alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmOverrideLinkPage.java |
Updates the IdP alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmLinkPage.java |
Updates the IdP-link alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPatternFlyAlert.java |
Updates the shared alert class for PF6. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/OneTimeCode.java |
Updates the OTP alert locator. |
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/FeedbackMessage.java |
Updates the shared feedback locator. |
tests/base/src/test/java/org/keycloak/tests/admin/ServerInfoTest.java |
Expects v3 login theme metadata. |
services/src/test/java/org/keycloak/compatibility/FeatureCompatibilityMetadataProviderTest.java |
Tests LOGIN_V3 compatibility. |
services/src/main/java/org/keycloak/services/resources/admin/info/ServerInfoAdminResource.java |
Filters v3 according to feature state. |
server-spi/src/main/java/org/keycloak/theme/ThemeSelectorProvider.java |
Makes v3 the enabled default. |
quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/FeaturePropertyMappersTest.java |
Validates the v3 feature key. |
model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java |
Registers the 27.0 migration. |
model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo27_0_0.java |
Moderate: Theme migration and import paths lack focused automated coverage. |
model/jpa/src/main/resources/META-INF/jpa-changelog-master.xml |
Includes the 27.0 changelog. |
model/jpa/src/main/resources/META-INF/jpa-changelog-27.0.0.xml |
Defines the login-theme migration. |
model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate27_0_0_UpdateLoginTheme.java |
Updates persisted JPA theme selections. |
misc/scripts/README.md |
Documents the PF5-to-PF6 migration helper. |
misc/scripts/migrate-login-theme-pf5-to-pf6.mjs |
Moderate: Migration does not rewrite removed v2 parent themes to v3. |
js/themes-vendor/pom.xml |
Packages PF6 vendor resources. |
js/themes-vendor/package.json |
Adds the PF6 dependency. |
js/pnpm-lock.yaml |
Locks PatternFly 6.6.1. |
js/apps/keycloak-server/README.md |
Updates development feature configuration. |
js/apps/admin-ui/src/realm-settings/themes/QuickTheme.tsx |
Moderate: Exported login themes still emit only PF5 color variables. |
js/apps/admin-ui/src/realm-settings/themes/LoginPreviewWindow.tsx |
Moderate: PF5 suffixes produce nonexistent PF6 preview tokens. |
docs/documentation/upgrading/topics/changes/changes.adoc |
Nit: Existing 26.7.3 and 26.7.2 upgrade sections were removed. |
docs/documentation/release_notes/topics/27_0_0.adoc |
Adds 27.0 theme release notes. |
docs/documentation/release_notes/index.adoc |
Includes the 27.0 release notes. |
common/src/test/java/org/keycloak/common/ProfileTest.java |
Tests v3 feature identifiers. |
common/src/main/java/org/keycloak/common/Profile.java |
Critical/Moderate: Removes required OID4VC_MDOC and changes client-secret rotation from default to preview. |
Review details
Files not reviewed (1)
- js/pnpm-lock.yaml: Generated file
Suppressed comments (5)
docs/documentation/upgrading/topics/changes/changes.adoc:27
- Adding 27.0.0 removed the existing 26.7.3 and 26.7.2 migration sections, so those upgrade instructions disappear from the generated guide. Restore both includes between 26.8.0 and 26.7.0.
=== Migrating to 26.8.0
include::changes-26_8_0.adoc[leveloffset=2]
js/apps/admin-ui/src/realm-settings/themes/LoginPreviewWindow.tsx:65
LoginPageandLoginFormare still imported from the Admin UI's PatternFly React 5 dependency, so they renderpf-v5-*classes and these PF6 selectors never match. Render the preview with PF6 components/styles (or an isolated realkeycloak.v3page) so it actually represents the new login UI.
.login-preview .pf-v6-c-login__main {
anchor-name: --logo;
}
.login-preview .pf-v6-c-login__footer {
misc/scripts/migrate-login-theme-pf5-to-pf6.mjs:340
- With
--apply --fail-on-unresolved, the source theme is replaced here before residuals trigger exit code 2 below. Gate apply mode on the unresolved check so a reported failure does not still modify the user's theme.
if (!failedStep && options.apply) {
themes/src/main/resources-community/theme/keycloak.v3/login/messages/messages_pt_BR.properties:1
- The old
resources-community/theme/keycloak.v2/login/messages/messages_pt_BR.propertiesfile still remains, so the built-in v2 theme has not been fully removed as described. Delete the stale v2 resource when adding this v3 translation.
themes/src/main/resources/theme/keycloak.v3/login/resources/js/password-policy.js:35 - JavaScript
\Wis ASCII-based, so Unicode letters and digits such aséare counted as special characters even though the server usesCharacter.isLetterOrDigit. Preserve the Unicode-aware expression so client-side feedback matches server validation.
- Files reviewed: 75/124 changed files
- Comments generated: 7
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
10000
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
A critical WebAuthn regression and multiple moderate UI, validation, migration-script, and test-selector issues remain unresolved.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- js/pnpm-lock.yaml: Generated file
Suppressed comments (7)
Previously missed (6) — in code that hasn't changed since the last review.
themes/src/main/resources/theme/keycloak.v3/login/resources/js/password-policy.js:35
\Wdoes not match the server policy's!Character.isLetterOrDigitsemantics: it excludes_from special characters and treats Unicode letters such aséas special. This makes client-side validation disagree with the server for valid passwords.
misc/scripts/migrate-login-theme-pf5-to-pf6.mjs:280- The temporary staging directory is never removed on success or failure, leaving a full copy of every custom theme under the system temp directory after each run. Wrap staging and reporting in
try/finallyand recursively removetempRootonce the report/apply operation finishes.
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/x509/X509IdentityConfirmationPage.java:51 - The PF6 warning alert is rendered with
pf-v6-c-alert pf-m-warning(seethemes/.../template.ftl:237), notpf-v6-c-warning, so this locator can never find the warning. Match the alert component plus modifier, while retaining the legacy fallback.
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/AbstractLoggedInPage.java:50 - This page object targets the Account Console, which still uses PatternFly React 5; only the login theme is upgraded here. Changing the title locator to a PF6 class makes the WebAuthn account-page title lookup fail.
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/fragments/ContentAlert.java:48 - These are account-console alerts, so they remain PF5, and
classNamecannot accept the XPath expression built fromROOT_ID. Use scoped CSS locators with the existing PF5 classes or alert access will fail.
docs/documentation/upgrading/topics/changes/changes.adoc:27 - Adding the 27.0.0 section removed the existing 26.7.3 and 26.7.2 migration sections, so those upgrade instructions disappear from the generated guide. Preserve both includes between 26.8.0 and 26.7.0.
js/apps/admin-ui/src/realm-settings/themes/LoginPreviewWindow.tsx:70
- The preview is still rendered by PatternFly React 5, so these PF6 selectors never match its login main or footer; logo anchoring and footer hiding therefore regress. Keep the PF5 selectors until this component itself moves to PatternFly React 6.
.login-preview .pf-v6-c-login__main {
anchor-name: --logo;
}
.login-preview .pf-v6-c-login__footer {
- Files reviewed: 77/126 changed files
- Comments generated: 2
- Review effort level: Balanced
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
One critical and six moderate functional issues remain unresolved.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- js/pnpm-lock.yaml: Generated file
Suppressed comments (4)
Previously missed (2) — in code that hasn't changed since the last review.
themes/src/main/resources/theme/keycloak.v3/login/resources/js/password-policy.js:35
\Wuses JavaScript's ASCII-only word definition, which disagrees with the server's!Character.isLetterOrDigit: for example,_is special on the server but not here, whileéis treated as special only here. This can show a password as valid client-side and then reject it server-side (or vice versa), so retain the Unicode letter/digit complement.
docs/documentation/upgrading/topics/changes/changes.adoc:29- Inserting the 27.0 section also removed the existing 26.7.3 and 26.7.2 upgrade-guide includes, even though both topic files still contain required breaking-change guidance. Restore those sections between 26.8.0 and 26.7.0 so older upgrade paths remain documented.
js/apps/admin-ui/src/realm-settings/themes/LoginPreviewWindow.tsx:45
- The preview still renders
LoginPage/LoginFormfrom PatternFly React 5 (@patternfly/react-core5.4), so its DOM usespf-v5-*classes and consumes PF5 variables. Emitting only PF6 tokens and targetingpf-v6-*selectors means color changes and the new layout selectors no longer affect the login preview; migrate the preview markup/dependency to PF6 or keep PF5 styling until that migration is done.
.map(([key, value]) => {
const cssVar = toPf6CssVar(key);
return cssVar ? `${cssVar}: ${value};` : undefined;
})
.filter((line): line is string => line !== undefined)
js/apps/admin-ui/src/realm-settings/themes/pf5ToPf6Tokens.ts:17
- These background mappings generate nonexistent PF6 variables such as
--pf-t--global--color--background--100; PF6 uses the--pf-t--global--background--color--…hierarchy (for example,background--color--primary--default). As a result, exportedkeycloak.v3themes ignore the configured background colors; map these entries to actual PF6 semantic tokens.
"BackgroundColor--light-100": "color--background--100",
"BackgroundColor--100": "color--background--100",
"BackgroundColor--300": "color--background--200",
"BackgroundColor--400": "color--background--200",
"BackgroundColor--dark-100": "color--background--highlight--default",
- Files reviewed: 77/128 changed files
- Comments generated: 2
- Review effort level: Balanced
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical and moderate login, Account UI, validation, preview, and migration issues remain unresolved.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- js/pnpm-lock.yaml: Generated file
Suppressed comments (2)
Previously missed (1) — in code that hasn't changed since the last review.
themes/src/main/resources/theme/keycloak.v3/login/resources/js/password-policy.js:35
\Wdoes not match the server-side policy: it treats Unicode letters/digits as special and does not treat_as special, whileSpecialCharsPasswordPolicyProvideruses!Character.isLetterOrDigit. This makes the client validator accept passwords the server rejects (and reject valid Unicode passwords); retain the Unicode letter/digit check.
docs/documentation/upgrading/topics/changes/changes.adoc:29
- Adding the 27.0 section removed the existing 26.7.3 and 26.7.2 upgrade-guide includes even though both source files still exist. Restore them so users upgrading through those releases do not lose their migration instructions.
=== Migrating to 26.8.0
include::changes-26_8_0.adoc[leveloffset=2]
=== Migrating to 26.7.0
- Files reviewed: 77/128 changed files
- Comments generated: 5
- Review effort level: Balanced
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Multiple moderate functional, accessibility, migration, and test-locator regressions remain unresolved.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- js/pnpm-lock.yaml: Generated file
Suppressed comments (5)
js/apps/admin-ui/src/realm-settings/themes/LoginPreviewWindow.tsx:71
LoginPageandLoginFormabove still come from PatternFly React 5 (@patternfly/react-core5.4.14), so their rendered elements havepf-v5-*classes. These PF6 selectors never match, causing the logo anchor and footer suppression to stop working in the preview; retain PF5 selectors until the preview components themselves are migrated.
.login-preview .pf-v6-c-login__main {
anchor-name: --logo;
}
.login-preview .pf-v6-c-login__footer {
misc/scripts/migrate-login-theme-pf5-to-pf6.mjs:210
- Java properties permits whitespace around the separator, so a common declaration such as
parent = keycloak.v2is left pointing at the removed theme; the residual scan also does not flag it, allowing a false-success report. Parse the parent declaration with optional whitespace/separators rather than exact string replacement.
.replaceAll("vendor/patternfly-v5/", "vendor/patternfly-v6/")
.replaceAll("pf-v5-theme-dark", "pf-v6-theme-dark")
.replaceAll("parent=keycloak.v2", "parent=keycloak.v3")
.replaceAll("parent=rh-sso.v2", "parent=keycloak.v3");
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/AbstractLoggedInPage.java:50
- This page object targets the account console, which still depends on PatternFly React 5 (
js/apps/account-ui/package.json), not the new login theme. Its title continues to renderpf-v5-c-title, so this locator will no longer find the page heading.
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/fragments/ContentAlert.java:48 - This fragment is used by the PF5 Account Console, not the login theme, and
classNamecannot accept the concatenated XPath expression. Use XPath locators with the existing PF5 alert classes so account WebAuthn alerts remain addressable.
themes/src/main/resources/theme/keycloak.v3/login/resources/js/password-policy.js:35 - This changes the client-side
specialCharsrule so it no longer matches the server policy:\Wtreats_as non-special and Unicode letters such aséas special, whileSpecialCharsPasswordPolicyProvideruses!Character.isLetterOrDigit. Users can therefore see validation results that contradict submission results; retain the Unicode letter/digit test.
- Files reviewed: 77/128 changed files
- Comments generated: 3
- Review effort level: Balanced
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testSavedPostRequest |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The PF6 login preview does not receive the dark-mode class, leaving uncustomized tokens in the light palette and making the preview differ from the exported theme.
13 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…keycloak.v2andrh-sso.v2…
1 resolved since last review
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
| <div className="login-preview login-pf"> | ||
| <div className="kc-logo-text"> | ||
| <span>Keycloak</span> | ||
| <div className="login-preview login-pf" data-testid="login-page-preview"> |
Contributor
Author
There was a problem hiding this comment.
Also the toggle is global and because the admin console itself is not yet using pf6 we'll always have this problem that either one doesn't work
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Unresolved defects leave the PF6 preview’s dark styling incomplete, break password-visibility icon updates, and cause errors when registering formatting handlers for cloned profile inputs.
13 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…keycloak.v2andrh-sso.v2…
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Unresolved defects prevent full dark-mode styling in the PF6 preview, break password-toggle icon handling, and cause initialization errors for cloned multivalued inputs.
13 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…keycloak.v2andrh-sso.v2…
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Unresolved regressions prevent dark styling in the login preview, break password-visibility icon updates, and cause errors when registering number-format handlers on dynamically added inputs.
13 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…keycloak.v2andrh-sso.v2…
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
Contributor
|
@edewit went through the PR and it looks ok to me. Are any of the copilot reviews valid, or can we go ahead and merge it? Or is this waiting on this one to be merged? |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved issues cause added-input formatting failures, incorrect password-visibility icons and dark-mode previews, Unicode digit validation mismatches, and redundant upgrade-time client scans.
14 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…keycloak.v2andrh-sso.v2…
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Unresolved functional defects can disable live password validation, cause errors when inputs are dynamically added, and leave the PF6 dark-mode preview inconsistent with the exported theme.
14 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…keycloak.v2andrh-sso.v2…
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
Contributor
Author
|
@vaceksimon yes I addressed all the co-pilot review comments that made sense |
Member
|
@edewit If CI pass, the PR #52724 will be automatically merged. It means that there will probably be some conflicts in your PR. For the WDYT? Let me know if you need some more hands for this. |
Contributor
|
I have tested it locally with v3 I could provide it tonight |
Introduce keycloak.v3 as the default login theme based on PatternFly 6, migrate legacy login themes during upgrade, and update admin Quick Theme preview tooling and tests accordingly. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
After rebasing onto main, the Login v1 removal note still pointed at keycloak.v2; update it to match the PatternFly 6 login migration. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The migration script preserves source symlinks during staging, allowing it to modify original theme files even in dry-run mode.
15 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…
1 resolved since last review
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved issues leave PF6 dark previews using light-mode defaults, add redundant per-client database reads during upgrades, and omit native required-field semantics from the TOTP input.
16 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
vaceksimon
approved these changes
Nov 11, 2026
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The PF6 login preview fails to activate dark-mode styles, and the migration script leaves staged theme directories in temporary storage after dry runs.
13 open issues
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…
4 resolved since last review
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
| const commonDir = await resolveSiblingCommonDir(loginDir); | ||
| const themeName = path.basename(path.dirname(loginDir)); | ||
| const runTimestamp = formatTimestamp(); | ||
| const tempRoot = await mkdtemp(path.join(tmpdir(), "kc-pf6-login-migrate-")); |
Member
There was a problem hiding this comment.
Can be done in a follow-up PR.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
An undefined PF6 size token can let social-provider logos expand inside buttons, and the input-text-color override is scoped where component declarations override it, leaving the control ineffective.
3 open issues
11 resolved since last review
themes/src/main/resources/theme/base/login, even though it is a…logindirectory. Custom login themes commonly use…--pf-t--global--background--color--100and…
1 file not reviewed
js/pnpm-lock.yaml: Generated file
Review effort: Balanced
| /** PF5 suffixes that must not share a global PF6 text token with Color--100. */ | ||
| const PF5_TO_PF6_COMPONENT_OVERRIDES: Record<string, string[]> = { | ||
| // inputTextColor: keep distinct from text--color--regular | ||
| "Color--dark-100": ["--pf-v6-c-form-control--Color"], |
rmartinc
reviewed
Nov 12, 2026
Contributor
There was a problem hiding this comment.
Thanks @edewit, @mabartos and @vaceksimon! I have detected some weird things. For example the error in webauthn:
The background image is cut when the page needs scroll:
The OTP selection is also weird:
What do you want to do? Fix those issues now or go with this and fix individual things as follow-ups?
Member
Translation Changes NotificationLanguage maintainers: Please review the translation changes in your 10BC8 language in Weblate. The following languages have been updated in this PR: Catalan (
|
Contributor
|
I reviewed the Swedish change in this PR. The new The copied wording is also not idiomatic Swedish. Suggested translation once the component has synchronized:
This avoids the previous unnatural word order and spaced slash punctuation. I will handle the correction through Weblate when the component becomes available. |
Member
|
To all translators including @yeager: Weblate is now updated, and you can change the translation there. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #52342
keycloak.v3as the default login theme on PatternFly 6, with a newLOGIN_V3feature flagkeycloak.v2login theme and theLOGIN_V2feature (no deprecated PF5 login support)keycloak.v2/rh-sso.v2login themes tokeycloak.v3on upgrade to 27.0.0Issue checklist
keycloak.v3theme,LOGIN_V3feature, default theme selector updated)keycloak.v3login theme, PatternFly 6 vendor assets)keycloak.v2login theme removed,LOGIN_V2feature removed)Test plan
ProfileTest,FeatureCompatibilityMetadataProviderTest,FeaturePropertyMappersTestkeycloak.v2login theme migrates tokeycloak.v3on upgradekeycloak.v2are documented to migrate viamigrate-login-theme-pf5-to-pf6.mjs