Authentication Failure with OIDC Client After Keycloak Upgrade and Missing "sub" Claim

1

Hello,

I recently upgraded my Keycloak instance to a newer version, and after the upgrade, I’m experiencing an authentication failure with my OIDC client. Upon checking the JWT token, I noticed that the subject (“sub”) claim is missing.

My questions are:

  1. Is the missing “sub” claim the reason for the failed authentication?
  2. Is there any way to handle authentication without the “sub” claim?
2

No, as you actually have a token, the user is already authenticated succesfully. If your application can‘t handle it, it‘s not related to the authentication itself.

Most likely during the upgrade, your client was not configured to use the new „basic“ client scope as default. The „sub“ claim was moved to this scope. Add it as a default scope to your client config and you are good to go.

3

Hello @dasniko,

I already have the basic claim in the client, but still having issues with the sub claim. The authorization is successful, but the token exchange fails. Any ideas?

Thanks in advance