You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Removing nonce from OpenID authentication request
#12824
Is there any setting in Keycloak to remove the nonce parameter from the OPENID authentication request?
Keycloak seems to always add it, and my Identity Provider is saying that they cannot add the nonce claim to the ID token that they return, so I am looking to remove this nonce.
@saravanac Keycloak is compliant with the OpenID spec, so I'm afraid that's not possible. Plus, removing the nonce can expose your application to replay attacks. Please check some quotes from the spec below:
String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. If present in the ID Token, Clients MUST verify that the nonce Claim Value is equal to the value of the nonce parameter sent in the Authentication Request. If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no other processing on nonce values used. The nonce value is a case sensitive string.
If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi,
Is there any setting in Keycloak to remove the nonce parameter from the OPENID authentication request?
Keycloak seems to always add it, and my Identity Provider is saying that they cannot add the nonce claim to the ID token that they return, so I am looking to remove this nonce.
I am using Keycloak server 15.1.1
Thank you.
All reactions
Replies: 2 comments
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
@saravanac Keycloak is compliant with the OpenID spec, so I'm afraid that's not possible. Plus, removing the nonce can expose your application to replay attacks. Please check some quotes from the spec below:
Source: http://openid.net/specs/openid-connect-core-1_0.html#IDToken
Source: http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
All reactions
Uh oh!
There was an error while loading. Please reload this page.
Can you help me, how did you or what process you used to add nonce in the id-token?
All reactions