
:guide-id: features
:guide-parent: 
:guide-title: Enabling and disabling features
:guide-summary: Configure {project_name} to use optional features.
:guide-priority: 999
:guide-tile-visible: true
:version: 26.4.0

include::../attributes.adoc[]

[[features]]
= Enabling and disabling features

ifeval::["" == "true"]
WARNING: This {section} is describing a feature which is currently in preview.
ifeval::["" == ""]
Please provide your feedback while we’re continuing to work on this.
endif::[]
ifeval::["" != ""]
Please provide your feedback by link:[joining this discussion] while we’re continuing to work on this.
endif::[]
endif::[]


{project_name} has packed some functionality in features, including some disabled features, such as Technology Preview and deprecated features. Other features are enabled by default, but you can disable them if they do not apply to your use of {project_name}.

== Enabling features

Some supported features, and all preview features, are disabled by default. To enable a feature, enter this command:

[source,bash]
----
bin/kc.[sh|bat] build --features="<name>[,<name>]"
----

For example, to enable `docker` and `token-exchange`, enter this command:

[source,bash]
----
bin/kc.[sh|bat] build --features="docker,token-exchange"
----

To enable all preview features, enter this command:

[source,bash]
----
bin/kc.[sh|bat] build --features="preview"
----

Enabled feature may be versioned, or unversioned.  If you use a versioned feature name, e.g. feature:v1, that exact feature version will be enabled as long as it still exists in the runtime.  If you instead use an unversioned name, e.g. just feature, the selection of the particular supported feature version may change from release to release according to the following precedence:

. The highest default supported version
. The highest non-default supported version
. The highest deprecated version
. The highest preview version
. The highest experimental version

== Disabling features

To disable a feature that is enabled by default, enter this command:

[source,bash]
----
bin/kc.[sh|bat] build --features-disabled="<name>[,<name>]"
----

For example to disable `impersonation`, enter this command:

[source,bash]
----
bin/kc.[sh|bat] build --features-disabled="impersonation"
----

It is not allowed to have a feature in both the `features-disabled` list and the `features` list.

When a feature is disabled all versions of that feature are disabled.

== Supported features

The following list contains supported features that are enabled by default, and can be disabled if not needed.

[cols="30%,70%"]
|===
| Feature | Description

| [.features-name]#account-api:v1# | [.features-description]#Account Management REST API#
| [.features-name]#account:v3# | [.features-description]#Account Console version 3#
| [.features-name]#admin-api:v1# | [.features-description]#Admin API#
| [.features-name]#admin-fine-grained-authz:v2# | [.features-description]#Fine-Grained Admin Permissions version 2#
| [.features-name]#admin:v2# | [.features-description]#New Admin Console#
| [.features-name]#authorization:v1# | [.features-description]#Authorization Service#
| [.features-name]#ciba:v1# | [.features-description]#OpenID Connect Client Initiated Backchannel Authentication (CIBA)#
| [.features-name]#client-policies:v1# | [.features-description]#Client configuration policies#
| [.features-name]#device-flow:v1# | [.features-description]#OAuth 2.0 Device Authorization Grant#
| [.features-name]#dpop:v1# | [.features-description]#OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer#
| [.features-name]#hostname:v2# | [.features-description]#Hostname Options V2#
| [.features-name]#impersonation:v1# | [.features-description]#Ability for admins to impersonate users#
| [.features-name]#kerberos:v1# | [.features-description]#Kerberos#
| [.features-name]#login:v2# | [.features-description]#New Login Theme#
| [.features-name]#opentelemetry:v1# | [.features-description]#OpenTelemetry Tracing#
| [.features-name]#organization:v1# | [.features-description]#Organization support within realms#
| [.features-name]#par:v1# | [.features-description]#OAuth 2.0 Pushed Authorization Requests (PAR)#
| [.features-name]#passkeys:v1# | [.features-description]#Passkeys#
| [.features-name]#persistent-user-sessions:v1# | [.features-description]#Persistent online user sessions across restarts and upgrades#
| [.features-name]#recovery-codes:v1# | [.features-description]#Recovery codes#
| [.features-name]#rolling-updates:v1# | [.features-description]#Rolling Updates#
| [.features-name]#step-up-authentication:v1# | [.features-description]#Step-up Authentication#
| [.features-name]#token-exchange-standard:v2# | [.features-description]#Standard Token Exchange version 2#
| [.features-name]#update-email:v1# | [.features-description]#Update Email Action#
| [.features-name]#user-event-metrics:v1# | [.features-description]#Collect metrics based on user events#
| [.features-name]#web-authn:v1# | [.features-description]#W3C Web Authentication (WebAuthn)#
|===

=== Disabled by default

The following list contains supported features that are disabled by default, and can be enabled if needed.

[cols="30%,70%"]
|===
| Feature | Description

| [.features-name]#docker:v1# | [.features-description]#Docker Registry protocol#
| [.features-name]#fips:v1# | [.features-description]#FIPS 140-2 mode#
| [.features-name]#multi-site:v1# | [.features-description]#Multi-site support#
|===

== Preview features

Preview features are disabled by default and are not recommended for use in production.
These features may change or be removed at a future release.

[cols="30%,70%"]
|===
| Feature | Description

| [.features-name]#admin-fine-grained-authz:v1# | [.features-description]#Fine-Grained Admin Permissions#
| [.features-name]#client-auth-federated:v1# | [.features-description]#Authenticates client based on assertions issued by identity provider#
| [.features-name]#client-secret-rotation:v1# | [.features-description]#Client Secret Rotation#
| [.features-name]#log-mdc:v1# | [.features-description]#Mapped Diagnostic Context (MDC) information in logs#
| [.features-name]#rolling-updates:v2# | [.features-description]#Rolling Updates for patch releases#
| [.features-name]#scripts:v1# | [.features-description]#Write custom authenticators using JavaScript#
| [.features-name]#spiffe:v1# | [.features-description]#SPIFFE trust relationship provider#
| [.features-name]#token-exchange:v1# | [.features-description]#Token Exchange Service#
|===

== Deprecated features


The following list contains deprecated features that will be removed in a future release. These features are disabled by default.

[cols="30%,70%"]
|===
| Feature | Description

| [.features-name]#instagram-broker:v1# | [.features-description]#Instagram Identity Broker#
| [.features-name]#login:v1# | [.features-description]#Legacy Login Theme#
| [.features-name]#logout-all-sessions:v1# | [.features-description]#Logout all sessions logs out only regular sessions#
| [.features-name]#passkeys-conditional-ui-authenticator:v1# | [.features-description]#Passkeys conditional UI authenticator#
|===



== Relevant options

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+features+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Enables a set of one or more features.#

[role="options-extended"]
--




*CLI:* `+--features+` +
*Env:* `+KC_FEATURES+`
--



|
`+account-api[:v1]+`, `+account[:v3]+`, `+admin-api[:v1]+`, `+admin-fine-grained-authz[:v1,v2]+`, `+admin[:v2]+`, `+authorization[:v1]+`, `+ciba[:v1]+`, `+client-auth-federated[:v1]+`, `+client-policies[:v1]+`, `+client-secret-rotation[:v1]+`, `+client-types[:v1]+`, `+clusterless[:v1]+`, `+db-tidb[:v1]+`, `+declarative-ui[:v1]+`, `+device-flow[:v1]+`, `+docker[:v1]+`, `+dpop[:v1]+`, `+dynamic-scopes[:v1]+`, `+fips[:v1]+`, `+hostname[:v2]+`, `+impersonation[:v1]+`, `+instagram-broker[:v1]+`, `+ipa-tuura-federation[:v1]+`, `+kerberos[:v1]+`, `+kubernetes-service-accounts[:v1]+`, `+log-mdc[:v1]+`, `+login[:v2,v1]+`, `+logout-all-sessions[:v1]+`, `+multi-site[:v1]+`, `+oid4vc-vci[:v1]+`, `+opentelemetry[:v1]+`, `+organization[:v1]+`, `+par[:v1]+`, `+passkeys-conditional-ui-authenticator[:v1]+`, `+passkeys[:v1]+`, `+persistent-user-sessions[:v1]+`, `+preview+`, `+quick-theme[:v1]+`, `+recovery-codes[:v1]+`, `+rolling-updates[:v1,v2]+`, `+scripts[:v1]+`, `+spiffe[:v1]+`, `+step-up-authentication[:v1]+`, `+token-exchange-external-internal[:v2]+`, `+token-exchange-standard[:v2]+`, `+token-exchange[:v1]+`, `+transient-users[:v1]+`, `+update-email[:v1]+`, `+user-event-metrics[:v1]+`, `+web-authn[:v1]+`, `+workflows[:v1]+`

|
[.options-key]#`+features-disabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Disables a set of one or more features.#

[role="options-extended"]
--




*CLI:* `+--features-disabled+` +
*Env:* `+KC_FEATURES_DISABLED+`
--



|
`+account+`, `+account-api+`, `+admin+`, `+admin-api+`, `+admin-fine-grained-authz+`, `+authorization+`, `+ciba+`, `+client-auth-federated+`, `+client-policies+`, `+client-secret-rotation+`, `+client-types+`, `+clusterless+`, `+db-tidb+`, `+declarative-ui+`, `+device-flow+`, `+docker+`, `+dpop+`, `+dynamic-scopes+`, `+fips+`, `+impersonation+`, `+instagram-broker+`, `+ipa-tuura-federation+`, `+kerberos+`, `+kubernetes-service-accounts+`, `+log-mdc+`, `+login+`, `+logout-all-sessions+`, `+multi-site+`, `+oid4vc-vci+`, `+opentelemetry+`, `+organization+`, `+par+`, `+passkeys+`, `+passkeys-conditional-ui-authenticator+`, `+persistent-user-sessions+`, `+preview+`, `+quick-theme+`, `+recovery-codes+`, `+rolling-updates+`, `+scripts+`, `+spiffe+`, `+step-up-authentication+`, `+token-exchange+`, `+token-exchange-external-internal+`, `+token-exchange-standard+`, `+transient-users+`, `+update-email+`, `+user-event-metrics+`, `+web-authn+`, `+workflows+`


|===
