Repository navigation
OIDC hardcoded claim mapper for azp
#50023
|
Hi folks, Thanks so much for all the work so far! We're using a mapper of type "Hardcoded claim" to overwrite the The reason for this is so it appears with the same audience as another OIDC client when presented to AWS. All this is a workaround to a hard AWS limit of 100 audiences per Identity Provider - and you can only register a Realm as an Identity Provider once per account. |
Replies: 1 comment
|
Using a hardcoded claim mapper to override That said, a few things worth noting for your specific case: Will it be "patched out"? Potential fragility to watch for:
Your AWS workaround is pragmatic. The 100-audience-per-IdP limit in AWS IAM is a real constraint and this is a valid way around it. If you want a more robust long-term solution, consider opening a Keycloak enhancement request for a first-class "audience alias" or "azp alias" mapper — it is a use case others li 8000 kely share. |
Using a hardcoded claim mapper to override
azpis intentional functionality in Keycloak, not a bug or an undocumented workaround. Protocol mappers are the supported extension point for customizing token claims, and the fact that they can override standard OIDC claims likeazpis by design.That said, a few things worth noting for your specific case:
Will it be "patched out"?
Unlikely. Keycloak's mapper pipeline processes all mappers in priority order, and allowing overrides of standard claims is intentional. If this were restricted, it would break many legitimate customization scenarios. The Keycloak team would need a strong security reason to block it.
Potential fragility to watch for: