[keycloak-user] Motivation behind the removal of client_id from "aud" in the JWT
Marek Posolda
mposolda at redhat.com
Wed Dec 5 03:30:52 EST 2018
On 26/11/2018 17:49, Cristian Schuszter wrote:
> Hi!
>
> We just updated from release 4.5.0 to 4.6.0 and discovered that the
> "aud" field has been changed to "aud": "account", rather than the
> client-id of the application.
>
> After a bit of digging, we found the commit and associated pull request
> for the change:
> https://github.com/keycloak/keycloak/commit/f67d6f96607e51b1839501203342faf9f6987503#diff-d45230ec2a55480bbaf022aee366e898R85
>
> Unfortunately, *KEYCLOAK-8482* issue seems to be hidden, as I couldn't
> find it on the Jira board.
>
> We were counting on the "client_id" being present in the audiences, as
> the Microsoft.NET core validators target specifically the audiences in
> the JWT token, with no option of targeting the "azp" field.
The client_id is still present in the ID Token by default. In the access
token it is not present by default now. However per OIDC/OAuth2
specification, the access token is just the opaque string. In theory,
you shouldn't assume any specific format of our access token when using
it with 3rd party adapter.
If you really need to add client_id to the "aud" field, you can achieve
it by adding Audience protocol mapper to your client and add the
client_id of your client to it. This will defacto add the "hardcoded"
client_id to the token.
Marek
>
> Could anybody shed some light as to why the *client_id* was removed from
> the audiences?
>
>
> Best regards,
>
> Cristian Schuszter
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
More information about the keycloak-user
mailing list