My application is authenticating to another application as a “backend” service via OAuth2. So far I have setup a new client in my realm that I will use to issue the access tokens for this service. The service has several requirements and I’ve managed to satisfy all of them except this one: they would like me to put the “client ID” they have issued my application in the “iss” claim of the token.
Keycloak is currently placing the URL for the realm in the “iss” claim. I tried adding a hard-coded claim for the “iss” claim with the client ID but that is being ignored by Keycloak.
Is there a way to specify the “iss” claim for a realm client such that it appears in the generated access tokens?
I did test with the access tokens and the error from this service looks to confirm that I do need to change the “iss” value, the error is “invalid_client”. I’m working with the Epic Systems EHR.
It looks like Keycloak is hard-coded to disallow overriding of some specific claims, “iss” is among these.
Removing line 111 in the file referenced above does resolve this issue for me. I have opened an issue with the project to try and figure out how best to proceed.
