mirrors/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-01-25 16:42:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow client_id as an audience in the JWT Authorization Grant and Client Assertions

Browse Source 
Closes #45178

Signed-off-by: rmartinc <rmartinc@redhat.com>
This commit is contained in:
rmartinc
2026-01-14 13:36:47 +01:00
committed by Marek Posolda
parent fccd46f7ba
commit 07b9b9656b
9 changed files with 102 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/documentation/server_admin/topics/identity-broker/oidc.adoc
View File

@@ -91,6 +91,9 @@ to forward are any non OpenID Connect/OAuth standard parameter or standard param
|Allows client assertions to be re-used
|By default, a client assertion can not be used multiple times. If the client is not able to retrieve a new client assertion for each request this option can be enabled to allow re-use of the same client assertion.
|Allows Client ID as audience for assertions
|If enabled, the Client ID configured in the Identity Provider is the only valid audience for assertions used in Federated client authentication and in JWT Authorization Grants (Client Assertions and JWT Authorization Grant). The client ID is used instead of the token-url/issuer-url defined in the respective specifications. Note this behavior is not covered by any standard.
|===
You can import all this configuration data by providing a URL or file that points to OpenID Provider Metadata. If you connect to a {project_name} external IDP, you can import the IDP settings from `<root>{kc_realms_path}/{realm-name}/.well-known/openid-configuration`. This link is a JSON document describing metadata about the IDP.