Repository navigation
Set custom audiences per client in the jwt audience executor - #46532
Conversation
|
@rmartinc The general idea is ok for me. I would keep the option to apply the audience also to all clients. Even if it’s not common, there could be a case where someone wants to just apply the audience to all clients, and configuring all of them in the map is not so easy. |
|
@graziang we are trying to avoid that, because we want the admin to configure the correct audience to the correct client. If you apply all audiences like before (to all clients managed by the policy), is like allowing the jwt authorization grant to all of them (because the ID token in google would be always the same one). Stian asked to restrict this behavior. |
|
@rmartinc Sorry, but I recall what we discussed (and pretty sure what @stianst mentioned) is to rather not use client policies, but instead have some per-client configuration. The client policies are ideal for the cases, when some configuration (or restriction) applies to many various clients, but not when every client can have different setting as:
|
ee137e3 to
326e32d
Compare
|
Finally I used the |
d7ecc5c to
73bc358
Compare
|
I have changed the |
|
I'm going to rebase this, I think that it's too old to just re-run it. |
Closes keycloak#46525 Signed-off-by: rmartinc <rmartinc@redhat.com>
Closes keycloak#46525 Signed-off-by: rmartinc <rmartinc@redhat.com>
Closes keycloak#46525 Signed-off-by: rmartinc <rmartinc@redhat.com>
…k#46532) Closes keycloak#46525 Signed-off-by: rmartinc <rmartinc@redhat.com>
Closes #46525
PR that configures the valid audiences for the jwt authorization grant audience executor per client. Initially I thought about adding the option in the client, but, in that case, the executor is not needed at all (the grant execution knows the valid audience just using the client configuration). So I decided to finally add the configuration in the executor per client. Let me know what you think.