jimmychakkalakal · May 13, 2026 · Oct 30, 2026 · Oct 30, 2026
@@ -142,12 +142,12 @@ image:images/client-federated-jwt.png[]
 
 *Signed JWT with Client Secret*
 
-If you select this option, you can use a JWT signed by client secret instead of the private key.
+If you select this option, the client can authenticate with a JWT using an HMAC and the client secret instead of asymmetric signing with a private key.
 The client secret can also reference a value stored in an <<_vault-administration,external vault>>.
 
-The client secret will be used to sign the JWT by the client.
+The client uses the shared secret to create a message authentication code for the JWT.
 
-Like in the *Signed JWT* authenticator you can configure the *Signature algorithm* and the *Max expiration* for the JWT token.
+You can configure the *MAC algorithm* and the *Max expiration* for the JWT. The MAC algorithm uses the shared secret to provide message authentication and integrity.
 
 *X509 Certificate*
 

@@ -35,9 +35,8 @@ JSON document with the claims that should be used to obtain user profile informa
 |Client Secret
 |Client secret from an external <<_vault-administration,vault>>. This secret is necessary if you are using the Authorization Code Flow.
 
-|Client Assertion Signature Algorithm
-|Signature algorithm to create JWT assertion as client authentication.
-In the case of JWT signed with private key or Client secret as jwt, it is required. If no algorithm is specified, the following algorithm is adapted. `RS256` is adapted in the case of JWT signed with private key.  `HS256` is adapted in the case of Client secret as jwt.
+|Client Assertion Algorithm
+|For `private_key_jwt`, the signature algorithm used to sign the JWT assertion. For `client_secret_jwt`, the HMAC algorithm used to create a message authentication code with the client secret. If no algorithm is specified, `RS256` is used with a private key and `HS256` with the client secret.
 
 |Client Assertion Audience
 |The audience to use for the client assertion. The default value is the IDP's token endpoint URL.

@@ -42,9 +42,8 @@ image:images/oidc-add-identity-provider.png[Add Identity Provider]
 |Client Secret
 |Client secret from an external <<_vault-administration,vault>>. This secret is necessary if you are using the Authorization Code Flow.
 
-|Client Assertion Signature Algorithm
-|Signature algorithm to create JWT assertion as client authentication.
-In the case of JWT signed with private key or Client secret as jwt, it is required. If no algorithm is specified, the following algorithm is adapted. `RS256` is adapted in the case of JWT signed with private key.  `HS256` is adapted in the case of Client secret as jwt.
+|Client Assertion Algorithm
+|For `private_key_jwt`, the signature algorithm used to sign the JWT assertion. For `client_secret_jwt`, the HMAC algorithm used to create a message authentication code with the client secret. If no algorithm is specified, `RS256` is used with a private key and `HS256` with the client secret.
 
 |Client Assertion Audience
 |The audience to use for the client assertion. The default value is the IDP's token endpoint URL.

@@ -74,6 +74,7 @@ eventTypes.VALIDATE_ACCESS_TOKEN.description=Validate access token
 dedicatedScopeExplain=This is a client scope which includes the dedicated mappers and scope
 updateOtpError=Could not update OTP policy\: {{error}}
 addressClaim.postal_code.label=User Attribute Name for Postal Code
+macAlgorithmHelp=HMAC algorithm used to authenticate a JWT assertion with the client secret.
 defaultRoles=Default roles
 samlSignatureKeyNameHelp=Signed SAML documents contain identification of signing key in KeyName element. For Keycloak / RH-SSO counter-party, use KEY_ID, for MS AD FS use CERT_SUBJECT, for others check and use NONE if no other option works.
 clientScopeTypes.default=Default
@@ -659,6 +660,8 @@ eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.description=Identity provider login err
 readTimeout=Read timeout
 userInfoResponseEncryptionContentEncryptionAlgorithmHelp=JWA Algorithm used for content encryption in encrypting User Info Endpoint responses. If User Info response encryption key management algorithm is specified, the default for this value is A128CBC-HS256.
 accessTokenSignatureAlgorithm=Access token signature algorithm
+accessTokenMacAlgorithm=Access token MAC algorithm
+accessTokenAlgorithm=Access token algorithm
 createUser=Create user
 logoutAllDescription=If you sign out all active sessions, active subjects in this realm will be signed out.
 credentialResetEmailError=Failed\: {{error}}
@@ -705,6 +708,8 @@ secretSize=Secret size
 included.custom.audience.label=Included Custom Audience
 max-clients.label=Max Clients Per Realm
 requestObjectSignatureAlgorithm=Request object signature algorithm
+requestObjectMacAlgorithm=Request object MAC algorithm
+requestObjectAlgorithm=Request object algorithm
 searchForGroups=Search group
 searchForOrganizations=Search organization
 noRolesAssociated=No associated roles
@@ -864,7 +869,9 @@ validity=Certificate expiration
 validityHelp=Number of years the generated certificate is valid for.
 membershipUserLdapAttributeHelp=Used only if the Membership Attribute Type is UID. It is the name of the LDAP attribute on the user, which is used for membership mappings. It is typically 'uid'. For example, if the value of 'Membership User LDAP Attribute' is 'uid' and the LDAP group has 'memberUid\: john', it is expected that particular LDAP user will have the attribute 'uid\: john'.
 samlCapabilityConfig=SAML capabilities
-accessTokenSignatureAlgorithmHelp=JWA algorithm used for signing access tokens.
+accessTokenAlgorithmHelp=JWA algorithm used to authenticate access tokens. Asymmetric algorithms create digital signatures; HS algorithms create an HMAC with a realm key.
+accessTokenSignatureAlgorithmHelp=Asymmetric JWA algorithm used to create a digital signature for access tokens.
+accessTokenMacAlgorithmHelp=HS JWA algorithm used to create an HMAC for access tokens with the realm's active symmetric key.
 derFormatted=DER formatted
 periodicFullSyncHelp=If 'Import users' is enabled, a periodic task is started to synchronize users from LDAP to Keycloak. This type of synchronization fetches all users from LDAP on every run, importing new users or updating existing ones. If you have a large number of users in LDAP, this may be inefficient. In that case, you can disable this option and use 'Periodic changed users sync' instead.
 periodicChangedUsersSyncHelp=If 'Import users' is enabled, a periodic task is started to synchronize users from LDAP to Keycloak based on their created or last updated timestamps. This type of synchronization is more efficient than a full sync, especially if you have a large number of users in LDAP. However, it requires that your LDAP server supports searching using the attributes 'createTimestamp' and 'modifyTimestamp' in query predicates.
@@ -943,6 +950,9 @@ deleteConfirmTitle_one=Delete group
 eventTypes.UPDATE_PROFILE_ERROR.description=Update profile error
 webAuthnUpdateSuccess=Updated WebAuthn policies successfully
 authorizationSignedResponseAlg=Authorization response signature algorithm
+authorizationResponseSignatureAlgorithm=Authorization response signature algorithm
+authorizationResponseMacAlgorithm=Authorization response MAC algorithm
+authorizationResponseAlgorithm=Authorization response algorithm
 includeInUserInfo.label=Add to userinfo
  item {{item}}
 back=Back
@@ -1072,6 +1082,9 @@ groupsPath=Groups path
 useRealmRolesMapping=Use realm roles mapping
 identityProviderEntityId=Identity provider entity ID
 userInfoSignedResponseAlgorithm=User info signed response algorithm
+userInfoResponseSignatureAlgorithm=User info response signature algorithm
+userInfoResponseMacAlgorithm=User info response MAC algorithm
+userInfoResponseAlgorithm=User info response algorithm
 selectGroup=Select group
 selectOrgGroup=Select Organization Group
 groupType=Group type
@@ -1858,6 +1871,7 @@ consoleDisplayConnectionUrlHelp=Connection URL to your LDAP server
 enabledWhen=Enabled when
 enabledWhenTooltip=Specifies when the attribute is available. When scopes are used, the attribute is available when at least one of the configured scopes is applied in the login request. Both default and optional scopes of the current request are evaluated. In the Admin Console and Account Console contexts, scopes are not evaluated and the attribute is always available (if not further restricted by permissions).
 clientAssertionSigningAlg=Client assertion signature algorithm
+clientAssertionMacAlg=Client assertion MAC algorithm
 homeURLHelp=Default URL to use when the auth server needs to redirect or link back to the client.
 ldapAttribute=LDAP attribute
 fullScopeAllowedHelp=Allows you to disable all restrictions. This switch is deprecated and will be removed in the future. It is recommended to have this disabled and configure just the needed roles to the client role scope.
@@ -1895,6 +1909,8 @@ eventTypes.UPDATE_EMAIL.name=Update email
 notBeforeHelp=Revoke any tokens issued before this time for this client. To push the policy, you should set an effective admin URL in the Settings tab first.
 protocolTypes.saml=SAML
 idTokenSignatureAlgorithm=ID token signature algorithm
+idTokenMacAlgorithm=ID token MAC algorithm
+idTokenAlgorithm=ID token algorithm
 displayHeaderHintHelp=A user-friendly name for the group that should be used when rendering a group of attributes in user-facing forms. Supports keys for localized values as well. For example\: ${profile.attribute.group.address}.
 providerInfo=Provider info
 ssoServiceUrl=Single Sign-On service URL
@@ -2252,7 +2268,9 @@ eventTypes.OAUTH2_DEVICE_AUTH.description=OAuth2 device authentication
 notBeforeClearedSuccess=Success\! "Not Before" cleared for realm.
 policySaveError=Could not update the policy: {{error}}
 experimental=Experimental
-idTokenSignatureAlgorithmHelp=JWA algorithm used for signing ID tokens.
+idTokenAlgorithmHelp=JWA algorithm used to authenticate ID tokens. Asymmetric algorithms create digital signatures; HS algorithms create an HMAC with a realm key.
+idTokenSignatureAlgorithmHelp=Asymmetric JWA algorithm used to create a digital signature for ID tokens.
 idTokenMacAlgorithmHelp=HS JWA algorithm used to create an HMAC for ID tokens with the realm's active symmetric key.
 deleteResourceConfirm=If you delete this resource, some permissions will be affected.
 httpPostBindingResponse=HTTP-POST binding response
 artifactBindingResponse=ARTIFACT binding response
@@ -2412,6 +2430,7 @@ validatingPublicKey=Validating public key
 permissionsListIntro=Edit the permission list by clicking the scope-name. It then redirects to the permission details page of the client named <1>{{realm}}</1>
 deleteClientConditionSuccess=Condition deleted successfully.
 signatureAlgorithm=Signature algorithm
+macAlgorithm=MAC algorithm
 deleteConfirmIdentityProvider=Are you sure you want to permanently delete the provider '{{provider}}'?
 resetActions=Reset Actions
 cibaExpiresInHelp=The expiration time of the "auth_req_id" in seconds since the authentication request was received.
@@ -2447,7 +2466,9 @@ generalSettings=General settings
 addClientProfileError=Could not create client profile\: '{{error}}'
 overallResults=Overall Results
 requiredUserActionsHelp=Require an action when the user logs in. 'Verify email' sends an email to the user to verify that user's email address. 'Update profile' requires the user to enter new personal information. 'Update password' requires the user to enter a new password. 'Configure OTP' requires setup of a mobile password generator.
-requestObjectSignatureAlgorithmHelp=JWA algorithm, which the client needs to use when sending an OIDC request object specified by the 'request' or 'request_uri' parameters. If set to 'any', the Request object can be signed by any algorithm (including 'none').
+requestObjectAlgorithmHelp=JWA algorithm used to authenticate an OIDC request object sent in the 'request' or 'request_uri' parameter. Asymmetric algorithms use a client private key; HS algorithms use the client secret.
+requestObjectSignatureAlgorithmHelp=Asymmetric JWA algorithm used to create a digital signature for the request object with the client's private key.
+requestObjectMacAlgorithmHelp=HS JWA algorithm used to create an HMAC for the request object with the client secret.
 ldapKerberosSettingsDescription=This section contains options useful for the Kerberos integration. This is used only when the LDAP server is used together with Kerberos/SPNEGO for user authentication.
 deleteEvents=Clear events
 termsOfServiceUrlHelp=URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service
@@ -2568,6 +2589,9 @@ eventTypes.OAUTH2_DEVICE_AUTH_ERROR.name=OAuth2 device authentication error
 addSubFlowHelp=Sub-Flows can be either generic or form. The form type is used to construct a sub-flow that generates a single flow for the user. Sub-flows are a special type of execution that evaluate as successful depending on how the executions they contain evaluate.
 implicitFlow=Implicit flow
 authorizationSignedResponseAlgHelp=JWA algorithm used for signing authorization response tokens when the response mode is jwt.
+authorizationResponseAlgorithmHelp=JWA algorithm used to authenticate authorization response JWTs. Asymmetric algorithms create digital signatures; HS algorithms create an HMAC with a realm key.
+authorizationResponseSignatureAlgorithmHelp=Asymmetric JWA algorithm used to create a digital signature for authorization response JWTs.
+authorizationResponseMacAlgorithmHelp=HS JWA algorithm used to create an HMAC for authorization response JWTs with the realm's active symmetric key.
 associatedRolesRemoved=Associated roles have been removed
 keyAliasHelp=Alias for the private key
 whoWillAppearLinkTextUsers=Who will appear in this group list?
@@ -3070,6 +3094,9 @@ deleteConfirmFlow=Delete flow?
 addRole=Add role
 FAIL=Fail import
 userInfoSignedResponseAlgorithmHelp=JWA algorithm used for signed User Info Endpoint response. If set to 'unsigned', User Info Response won't be signed and will be returned in application/json format.
+userInfoResponseAlgorithmHelp=JWA algorithm used to authenticate a signed UserInfo response. Asymmetric algorithms create digital signatures; HS algorithms create an HMAC with a realm key. If set to 'unsigned', the response is returned as application/json without signing.
+userInfoResponseSignatureAlgorithmHelp=Asymmetric JWA algorithm used to create a digital signature for UserInfo responses.
+userInfoResponseMacAlgorithmHelp=HS JWA algorithm used to create an HMAC for UserInfo responses with the realm's active symmetric key.
 lastName=Last name
 isAccessTokenJWT=Access Token is JWT
 deleteConfirmDialog_one=Are you sure you want to permanently delete {{count}} selected user
@@ -3124,7 +3151,7 @@ strictTransportSecurityHelp=The Strict-Transport-Security HTTP header tells brow
 authenticationExplain=Authentication is the area where you can configure and manage different credential types.
 passwordPoliciesHelp.hashIterations=The number of times a password is hashed before storage or verification. Default\: -1 in case argon2 is used as the hashing algorithm; 210,000 in case pbkdf2-sha512 is used as the hashing algorithm; 600,000 if the pbkdf2-sha256 algorithm is used as the hashing algorithm; 1,300,000 if the pbkdf2 algorithm is used as the hashing algorithm.
 dropNonexistingGroupsDuringSync=Drop non-existing groups during sync
-clientAssertionSigningAlgHelp=Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or JWT signed with client secret, it is required. If no algorithm is specified, the following algorithm is adapted. RS256 is adapted in the case of JWT signed with private key. HS256 is adapted in the case of JWT signed with client secret.
+clientAssertionSigningAlgHelp=Signature algorithm to create a JWT assertion as client authentication with a private key. If no algorithm is specified, RS256 is used.
 jwtX509HeadersEnabledHelp=If enabled, the x5t (X.509 Certificate SHA-1 Thumbprint) header will be added to the JWT to reference the certificate used to sign it. Otherwise, the kid (Key ID) header will be used instead.
 addProvider_other=Add {{provider}} providers
 resetAction=Reset action