Repository navigation
FAPI 2.0 Security Profile Final - only accept its issuer identifier value as a string in the aud claim received in client authentication assertions #41119
Description
Description
For Keycloak to fully comply with FAPI 2.0 Security Profile Final, Keycloak needs to do as follows:
According to the item 8 of section 5.3.2.1 of FAPI 2.0 Security Profile Final specification,
- On receiving a client authentication assertion from a client, Keycloak only accept its issuer identifier value as a string in the aud claim received in the client authentication assertion.
- the issuer value is equal to the issuer claim value of the server metadata that the client can obtain by accessing well-known URI.
Discussion
No response
Motivation
Making Keycloak fully comply with FAPI 2.0 Security Profile Final specification.
Details
No response
Metadata
Metadata
Assignees
Labels
Type
Fields
No fields configured for issues without a type.
Activity
FAPI 2.0 Final - only accept its issuer identifier value as a string …
[-]FAPI 2.0 Final - only accept its issuer identifier value as a string in the aud claim received in client authentication assertions[/-][+]FAPI 2.0 Security Profile Final - only accept its issuer identifier value as a string in the aud claim received in client authentication assertions[/+]