You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, when creating a custom Action Token for use with a custom Required Action, the signing algorithm for the token is HS256, using the realm's default HS256 key. This seems to be because the signing algorithm is chosen based on the TokenCategory, which for is INTERNAL by default for Action Tokens (inherited from org.keycloak.representations.JsonWebToken#getCategory).
Is it safe to simply return a different category like ACCESS_TOKEN from an override, in order to achieve a RS256 signature, or does this have side effects? The action token is passed to an external service which should validate the token and extract some information from it, but we do not want to expose Keycloak's secret signing key to the external service.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Currently, when creating a custom Action Token for use with a custom Required Action, the signing algorithm for the token is HS256, using the realm's default HS256 key. This seems to be because the signing algorithm is chosen based on the
TokenCategory, which for isINTERNALby default for Action Tokens (inherited fromorg.keycloak.representations.JsonWebToken#getCategory).Is it safe to simply return a different category like
ACCESS_TOKENfrom an override, in order to achieve a RS256 signature, or does this have side effects? The action token is passed to an external service which should validate the token and extract some information from it, but we do not want to expose Keycloak's secret signing key to the external service.All reactions