Validated Audiences do not match Client Token

[Keith3679]

When I attempt to validate the token form Keycloak, I am receiving the following error:

Microsoft.IdentityModel.Tokens.SecurityTokenInvalidAudienceException: IDX10214: Audience validation failed. Audiences: 'master-realm, account'. Did not match: validationParameters.ValidAudience: 'null' or validationParameters.ValidAudiences: 'lamp-app'.

at Microsoft.IdentityModel.Tokens.Validators.ValidateAudience(IEnumerable1 audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateAudience(IEnumerable1 audiences, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()

My token request in Postman is as follows:

When I add the following, everything works…

            services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        }).AddJwtBearer(o =>
        {
            o.Authority = "http://localhost:8080/auth/realms/master";

            o.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
            {
                ValidAudiences = new string[] { "master-realm", "account", "lamp-app" }
            };

So why is Keycloak returning the Audiences “master-realm” and “account” and not “lamp-app”?

[regilero]

The audience management for access tokens has changed.

You can check this other discussion:

Audience validation failed with Keycloak 8.x in Owin.Security.Keycloak .Net library

The newer versions of Keycloak server has changed how the audience claim (“aud”) is set in the access token. The library (Owin.Security.Keycloak) assumes that the Keycloak Client ID is in the “aud” claim, which no longer is the case by default. One way to fix it is in Keycloak admin UI, add a mapper in to the Keycloak Client that’s being used. Name: Audience Mapper type: Audience Included Client Audience: [Client ID] Also, make sure the .NET library is configured with option DisableAllRefre…

I also made a bug report with some infos on that: Breaking change in 'aud' audience content for access tokens · Issue #12415 · keycloak/keycloak · GitHub