Removing nonce from OpenID authentication request #12824

saravanac · 2022-06-29T15:58:23Z

saravanac
Jun 29, 2022

Hi,

Is there any setting in Keycloak to remove the nonce parameter from the OPENID authentication request?

Keycloak seems to always add it, and my Identity Provider is saying that they cannot add the nonce claim to the ID token that they return, so I am looking to remove this nonce.

I am using Keycloak server 15.1.1

Thank you.

abstractj · 2022-07-04T14:25:46Z

abstractj
Jul 4, 2022
Maintainer

@saravanac Keycloak is compliant with the OpenID spec, so I'm afraid that's not possible. Plus, removing the nonce can expose your application to replay attacks. Please check some quotes from the spec below:

String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. If present in the ID Token, Clients MUST verify that the nonce Claim Value is equal to the value of the nonce parameter sent in the Authentication Request. If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no other processing on nonce values used. The nonce value is a case sensitive string.

Source: http://openid.net/specs/openid-connect-core-1_0.html#IDToken

If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication

Source: http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation

0 replies

09abhishek · 2022-10-20T19:16:22Z

09abhishek
Oct 20, 2022

Can you help me, how did you or what process you used to add nonce in the id-token?

0 replies

Navigation Menu

Repository navigation

Removing nonce from OpenID authentication request #12824

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Removing nonce from OpenID authentication request #12824

Uh oh!

saravanac Jun 29, 2022

Replies: 2 comments

Uh oh!

Uh oh!

abstractj Jul 4, 2022 Maintainer

Uh oh!

09abhishek Oct 20, 2022

saravanac
Jun 29, 2022

abstractj
Jul 4, 2022
Maintainer

09abhishek
Oct 20, 2022