What problem does it solve? Upgrading Keycloak is risky when custom Identity Provider SPIs depend on internal APIs that can break across versions, and Keycloak does not support downgrades once the database is migrated. This Skill provides a structured end-to-end process covering version synchronization, official migration guide review, SPI recompilation and testing, production rollout, and rollback planning. ## Core Features & Use Cases - Version Sync Verification: A script scans the Dockerfile image tag, both provider pom keycloak.version properties, and frontend keycloak-js to detect mismatches before upgrading. - SPI Compatibility Workflow: Step-by-step guidance for recompiling and testing custom Wargaming and QQ Identity Provider SPIs against the target Keycloak version, including known high-risk internal APIs. - Edge Case Checklist: Thirteen documented edge cases covering database migration, session loss, redirect URI wildcard tightening, OpenTofu realm reconciliation, and rollback procedures. - Use Case: When bumping Keycloak from 26.6.4 to 26.7, run the version check script, review the official upgrading guide against the project, rebuild both providers with JDK 21, smoke-test all four login flows, and execute a backup-first production upgrade with a rollback plan. ## Quick Start Ask the AI to plan and execute a Keycloak upgrade to a target version, starting with the version synchronization check and custom SPI compatibility assessment.
