How to get client access token, that keycloak will accept? #39371

mocenas · 2025-04-30T13:01:38Z

mocenas
Apr 30, 2025

I'm trying to authenticate my client (not user) using JWT Bearer token. Problem is that token is not accepted by keycloak (same instance as generated it).

First I generated the token using equivalent to:

  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "grant_type=client_credentials" \
  "$HOST/realms/$REALM/protocol/openid-connect/token

I receive the token in format eyJhbGc..... Token is valid JWT, signed, looks all good.

Then I try to use the token to send request against keycloak and receive HTTP status 401 and error: KC-SERVICES0025: Error when validating client assertion: java.lang.RuntimeException: Issuer mismatch. The issuer should match the subject

According to #15688 this is not a bug but a feature.
But AFAIK:

issuer is entity that created the token (should be something like https://keycloak.domain.com/realms/whatever)
subject is the user that request the token (e.g. johndoe@domain.com or userId or something like it)

I'm sorry if I'm missing something obvious but how can these two ever be same? (in my case "iss" = "http://localhost:32900/realms/test-realm", "sub" = "57a112b7-6f38-415e-8ef5-bfd5d62e7aa1").

Or to help my problem - how can I generate an access token that keycloak will actually accept?

Answered by mocenas

May 22, 2025

Eventually we figured out that above mentioned workflow is not supported in keycloak. If we want to access keycloak using token as client_assertion we need to use signed JWT, not tokens generated by keycloak. In case of signed JWT it actually has same "issuer" and "subject" claims as in this case client is signing token for himself.

View full answer

mocenas · 2025-05-21T07:47:44Z

mocenas
May 21, 2025
Author

To put this in a perspective. I'm trying to authenticate keycloak client using token. E.g. for token introspection.
To reproduce the problem:

Download test-realm-realm.json and put it in /tmp/realms/
Start keycloak docker run -p 8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin -v /tmp/realms:/opt/keycloak/data/import quay.io/keycloak/keycloak:26.2.4 start-dev --import-realm
Get token token=$(curl -d "client_id=test-application-client" -d "client_secret=test-application-client-secret" -d "grant_type=client_credentials" "localhost:8080/realms/test-realm/protocol/openid-connect/token" | jq -r '.access_token')
Try to use the token to introspect something:

curl -d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
    -d "client_assertion=$token" \
    -d "token_type_hint=access_token" \
    -d "token=whatever_to_introspect" \
    http://localhost:8080/realms/test-realm/protocol/openid-connect/token/introspect

Result is {"error":"invalid_request","error_description":"Authentication failed."} And keycloak has in log: KC-SERVICES0025: Error when validating client assertion: java.lang.RuntimeException: Issuer mismatch. The issuer should match the subject


What is wrong in this flow? How can I make it work?

0 replies

mocenas · 2025-05-22T09:05:23Z

mocenas
May 22, 2025
Author

Eventually we figured out that above mentioned workflow is not supported in keycloak. If we want to access keycloak using token as client_assertion we need to use signed JWT, not tokens generated by keycloak. In case of signed JWT it actually has same "issuer" and "subject" claims as in this case client is signing token for himself.

0 replies

Navigation Menu

Repository navigation

How to get client access token, that keycloak will accept? #39371

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How to get client access token, that keycloak will accept? #39371

Uh oh!

mocenas Apr 30, 2025

Replies: 2 comments

Uh oh!

mocenas May 21, 2025 Author

Uh oh!

mocenas May 22, 2025 Author

mocenas
Apr 30, 2025

mocenas
May 21, 2025
Author

mocenas
May 22, 2025
Author