Federated client authentication feedback #45705

stianst · 2026-01-23T07:13:55Z

stianst
Jan 23, 2026
Maintainer

We would like feedback on the new federated client authentication preview feature in Keycloak. Share your use-cases, and let us know if this feature works for you or not. If you encounter any issues or pain points while trying out the feature let us now!

See here for the full blog post: https://www.keycloak.org/2026/01/federated-client-authentication

baptistegh · 2026-03-18T06:26:05Z

baptistegh
Mar 18, 2026

I am trying to authenticate Gitlab pipelines to Keycloak with their id_tokens.

Their sub in ID token is something like : project_path:{group}/{project}:ref_type:{type}:ref:{branch_name}. I manage to change this behavior and now the sub is only project_path:{project}. I created a client in Keycloak matching this sub but Keycloak shows me :

2026-03-18 06:11:14,258 WARN  [org.keycloak.events] (executor-thread-10) type="CLIENT_LOGIN_ERROR",
realmId="44428e85-2ffc-4772-8ca8-dd10319cab03", realmName="test_gitlab_realm", clientId="null",
userId="null", ipAddress="xxxxxxx", error="client_not_found", client_assertion_id="25cdb6f7-e87b-4528-84e4-ed994244748d",
grant_type="client_credentials", client_assertion_issuer="https://[GITLAB_HOST]", client_assertion_sub="project_path:[PROJECT_PATH]"

But I am sure a Client ID with the same name exists. I also correctly configured the Identity Provider in Keycloak (Token exchange can be done though).

4 replies

dextercd Mar 21, 2026

Hey @baptistegh,

I also had some trouble getting this working. Turns out, the client-auth-federated feature won't work on realms that were created before this feature was enabled. For existing realms, you have to go into the authentication settings, copy the clients flow, edit it to add the "Signed JWT - Federated" as an Alternative step.

After this, you have to "bind" the new flow to replace the built-in clients flow.

This is described in the documentation under Kubernetes identity providers.

But I am sure a Client ID with the same name exists.

This is not a requirement in Keycloak. You have to go into the client's credentials settings and switch 'Client Authenticator' to 'Signed JWT - Federated' and put the idp alias you assigned to GitLab and sub value GitLab puts inside its token here.

Also note that 'Supports client assertions' has to be enabled on the identity provider.

baptistegh Mar 21, 2026

Thanks for your answer.

After some troubles, I could make this work.

Is there any way to set up something else as the "sub" ?

Because one Keycloak client per Gitlab projet/branch is a pain.

I would lot having like one Keycloak client for a Gitlab group or something like that.

This is located under namespace_id for example.

Or having a regex thing would be great ! I don't know if that is wanted.

dextercd Mar 22, 2026

I don't think Keycloak has a feature like that.

Microsoft Entra Id does with its preview feature called Flexible federated identity credentials.

Instead of doing GitLab -> Keycloak (exact match) you could do GitLab -> Entra Id (flexible match) -> Keycloak (exact match).

I haven't tested doing multiple jwt exchanges like this, and it does seem quite convoluted.

Probably would be better if Keycloak had a feature like this instead. Maybe it can be proposed on the discussion forum.

baptistegh Mar 22, 2026

Well.. thanks for the idea but it seems like an overhead. And we don't use Entra ID at my work.

I would really want that feature in Keycloak, maybe it will be soon.

Navigation Menu

Repository navigation

Federated client authentication feedback #45705

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Federated client authentication feedback #45705

Uh oh!

Uh oh!

stianst Jan 23, 2026 Maintainer

Replies: 1 comment · 4 replies

Uh oh!

Uh oh!

baptistegh Mar 18, 2026

Uh oh!

Uh oh!

dextercd Mar 21, 2026

Uh oh!

baptistegh Mar 21, 2026

Uh oh!

dextercd Mar 22, 2026

Uh oh!

baptistegh Mar 22, 2026

stianst
Jan 23, 2026
Maintainer

Replies: 1 comment 4 replies

baptistegh
Mar 18, 2026