Azure AD as external identity provider

Configuring the server
1

Hello.

I have configured Azure AD as an external IDP. But Azure AD returns ID Token and Access Token with different iss claim. I don’t have access to Azure AD, can I somehow work around this problem on the Keycloak side? May by write custom Java extension or something…
In fact, I need only ID Token.
I am using Keycloak 26.

Thanks.

2

Do you have “Access token is JWT” enabled? Then Keycloak is trying to verify the AccessToken, which fails with MS, as MS uses different systems for ID and Access, like you already experienced.

Try disabling “Access token is JWT”, then Keycloak should ignore the AccessToken.

1 Like