// ------------------------ Breaking changes ------------------------  //
== Breaking changes

=== The `view-system` admin role no longer exists

Since version 26.5.4, when introduced, the `view-system` admin role was marked as deprecated. In this release, the role
has been removed for security reasons.

Access to full server information is now restricted to users in the `master` realm holding the `manage-realm` role.

If you are still relying on the `view-system` role, you should consider accessing the full server information using a user
(or service account) from the `master` realm and granted with `manage-realm` admin roles.

Before upgrading, you should check if any of your users, service accounts, or groups are still relying on the
`view-system` role and review their access controls to ensure they have the necessary permissions to access the server
information after the upgrade. The `manage-realm` admin role is a high-privileged role and should only be granted to
highly-trusted accounts.

=== Legacy client-initiated account linking endpoint disabled by default

The deprecated link:{developerguide_link}#_legacy-client-initiated-account-linking[legacy client-initiated account linking] endpoint (`/realms/{realm}/broker/{provider}/link`) is now disabled by default. Migrate to link:{adminguide_link}#con-aia_server_administration_guide[Application Initiated Actions (AIA)] with `kc_action=idp_link`. See link:{developerguide_link}#_client-initiated-account-linking[Client initiated account linking] for details.

To temporarily restore the previous behavior, see link:https://www.keycloak.org/server/all-provider-config#_openid_connect[OpenID Connect provider configuration] and enable `allow-client-initiated-account-linking` server option. This option is deprecated and will be removed in a future release.
