I'm not convinced about that approach. We'll end up having to test and maintain this in the long run. How about a staged approach instead: * Keycloak 2.1 & RH-SSO 7.0.1 - add scope=openid, also add mention in release not and migration guide that the ID token will soon not be included anymore * Keycloak 2.3 & RH-SSO 7.1 - stop sending ID token if scope is not included On 30 June 2016 at 16:00, Marek Posolda <mposolda(a)redhat.com <mailto:mposolda@redhat.com>> wrote: I am thinking whether to add configuration switch in admin console per client, where you can define what is the adapter version the particular client is using. In that case, some behaviour can be different/backwards compatible. Example: For new clients, we will include IDToken just if they use "scope=openid" . However for clients with adapter "1.9" or older, the IDToken will be included even if "scope=openid" is not used. WDYT? Marek _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-dev