Repository navigation
Replies: 3 comments 2 replies
|
Ok it looks like this behavior is very intentional But why? Does this introduce any security issues? |
|
according to the git history there was a issue in jira KEYCLOAK-8482 , but I cannot find it |
|
I noticed this issue quite a while ago, while I found various notes on this change, the why has not been answered. This is espeically an issue if you use the Spring security Keycloak Adapter, the keycloak.json file only contains a single resource/client which is both used for the redirect as well as for the audience check, so the best practice to use a frontend and backend Client cannot be implemented with this Adapter. I ended up with writing my own audience resolve mapper. |
|
Looking at the documentation, this seems to be very much intentional indeed. A workaround and advice is included as well. |
|
Thanks for the link to the documentation! Still it would be interesting why it is not recommended. I guess the idea is that a service is talking to itself is strange, but does this come with any security considerations why they disabled this? |
Uh oh!
There was an error while loading. Please reload this page.
Hi,
I just noticed that I have a confidential client X that defines a role A. Client X has also service account enabled and gets its own role A assigned.
If I create a jwt I noticed that client x is missing the client x audience entry. Usually if I would assign any other client the role A the audience is there without any extra mappers.
Is this on purpose so? I know it is maybe not a common use case but why is there an exception for that?
All reactions