Custom claims are not added to token after keycloak version update from 26.1.2 to 26.3.3 #42101

lusnyaktah · 2025-08-25T13:40:37Z

lusnyaktah
Aug 25, 2025

I've updated keycloak version from 26.1.2 to 26.3.3.
We have a custom context mapper where we add custom claims to the token, overriding the method

ContextMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper {}

@Override
    public AccessToken transformAccessToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession keycloakSession,
                                            UserSessionModel userSession, ClientSessionContext clientSessionCtx) {}

locally, when I get an access token, then extract JWT token I can see that it contains custom claims, but in the deployed version, when the access token request contains custom client scope, the access token doesn't contain custom claims. When I changed the keycloak logs, I noticed that transformAccessToken method not called as the logs that I added are missing.

I can't find what changed in Keycloak between those two versions that affected to token custom claims.

Can you help me find the problem?

Here is the client defination in deployment

 {
  "clientId": "integration-test",
  "name": "",
  "description": "",
  "rootUrl": "http://localhost:8081",
  "adminUrl": "http://localhost:8081",
  "baseUrl": "",
  "surrogateAuthRequired": false,
  "enabled": true,
  "alwaysDisplayInConsole": false,
  "clientAuthenticatorType": "client-secret",
  "secret": "******",
  "redirectUris": [
    "*"
  ],
  "webOrigins": [
    "*"
  ],
  "notBefore": 0,
  "bearerOnly": false,
  "consentRequired": false,
  "standardFlowEnabled": true,
  "implicitFlowEnabled": false,
  "directAccessGrantsEnabled": true,
  "serviceAccountsEnabled": true,
  "publicClient": false,
  "frontchannelLogout": true,
  "protocol": "openid-connect",
  "attributes": {
    "client.secret.creation.time": "1720180030",
    "standard.token.exchange.enabled": "false",
    "frontchannel.logout.session.required": "true",
    "oauth2.device.authorization.grant.enabled": "false",
    "backchannel.logout.revoke.offline.tokens": "false",
    "use.refresh.tokens": "true",
    "realm_client": "false",
    "oidc.ciba.grant.enabled": "false",
    "client.use.lightweight.access.token.enabled": "false",
    "backchannel.logout.session.required": "true",
    "client_credentials.use_refresh_token": "false",
    "tls.client.certificate.bound.access.tokens": "false",
    "require.pushed.authorization.requests": "false",
    "acr.loa.map": "{}",
    "display.on.consent.screen": "false",
    "token.response.type.bearer.lower-case": "false"
  },
  "authenticationFlowBindingOverrides": {},
  "fullScopeAllowed": true,
  "nodeReRegistrationTimeout": -1,
  "protocolMappers": [
    {
      "name": "Client ID",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usersessionmodel-note-mapper",
      "consentRequired": false,
      "config": {
        "user.session.note": "client_id",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "client_id",
        "jsonType.label": "String"
      }
    },
    {
      "name": "Client Host",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usersessionmodel-note-mapper",
      "consentRequired": false,
      "config": {
        "user.session.note": "clientHost",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "clientHost",
        "jsonType.label": "String"
      }
    },
    {
      "name": "Client IP Address",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usersessionmodel-note-mapper",
      "consentRequired": false,
      "config": {
        "user.session.note": "clientAddress",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "clientAddress",
        "jsonType.label": "String"
      }
    },
    {
      "name": "name",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usermodel-attribute-mapper",
      "consentRequired": false,
      "config": {
        "aggregate.attrs": "false",
        "userinfo.token.claim": "true",
        "multivalued": "false",
        "user.attribute": "displayName",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "name"
      }
    },
    {
      "name": "Context Mapper",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-context-mapper",
      "consentRequired": false,
      "config": {
        "id.token.claim": "true",
        "access.token.claim": "true",
        "introspection.token.claim": "true",
        "userinfo.token.claim": "false"
      }
    }
  ],
  "defaultClientScopes": [
    "web-origins",
    "acr",
    "roles",
    "profile",
    "basic",
    "email"
  ],
  "optionalClientScopes": [
    "address",
    "microprofile-jwt",
    "offline_access",
    "phone",
    "platform.products:delete",
    "platform.authenticators:all",
    "platform.groups:delete",
    "platform.authenticators:read",    
    "platform.notifications:all",
    "platform.provision:update",
    "platform.tenants:update",
    "platform.solutions:read"
  ],
  "access": {
    "view": true,
    "configure": true,
    "manage": true
  }
}

Navigation Menu

Repository navigation

Custom claims are not added to token after keycloak version update from 26.1.2 to 26.3.3 #42101

Uh oh!

10000 {{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Custom claims are not added to token after keycloak version update from 26.1.2 to 26.3.3 #42101

Uh oh!

Uh oh!

lusnyaktah Aug 25, 2025

Replies: 0 comments

lusnyaktah
Aug 25, 2025