Repository navigation
Service Account Scope removal #40758
Unanswered
andersjdba
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hello everyone,
I’m hoping to tap into the collective wisdom here around the recent move of the Client ID, Client Host and Client IP Address session note mappers into the dedicated
service_accountclient scope in Keycloak 26.1.In our environment we don’t rely on those mappers for our regular clients and we prefer not to have those claims injected into our access tokens. Until now, we’ve leveraged a client policy to detect and remove those built-in mappers during client provisioning, which worked fine.
Per the 26.1 upgrade guide:
Removing the scope is straightforward when we manage clients via our external tooling, but if someone edits the client in the admin console, Keycloak automatically re-assigns the
service_accountscope. We’ve patched our client policy to strip it out right after any update, but that feels like a workaround rather than a best-practice.Ideally, we’d like a way to indicate "this client doesn’t need its service-account mappers" (Somewhere around here perhaps? ClientManager.java#L169) so Keycloak won’t re-attach the scope automatically.
Has anyone faced the same requirement? How are you ensuring that service-account mappers stay disabled on clients that don’t need them even if someone updates in the admin console?
We're using 26.2.5 not 26.1 I make mention of 26.1 as this is when this was introduced.
Thanks in advance for any pointers!
All reactions