Re: [keycloak-user] configure keycloak nbf value in jwt token

Hello Xiaoling, Internally, Keycloak does track NBF value on the realm, client and user levels, but never propagates it to the tokens. It can only be seen as the "not-before-policy" property of the token response. Not sure if it's a bug, I hope Keycloak developers can tell more about it. As a workaround, you can either: - hardcode a non-zero value into the "nbf" claim, using Hardcoded Claim mapper in your client, or - compute the value similarly to how it is done in TokenManager [1], using Script Mapper and setting it via the token.notBefore() method. [1] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... Good luck, Dmitry Telegin CTO, Acutus s.r.o. Keycloak Consulting and Training Pod lipami street 339/52, 130 00 Prague 3, Czech Republic +42 (022) 888-30-71 E-mail: info(a)acutus.pro On Tue, 2019-01-22 at 17:20 +0000, Xiaoling Chen wrote: