CODEWITHSUNDEEP
keycloakkeycloak-gatekeeper
arkadiy kraportov
arkadiy kraportov

Reputation: 3729

Keycloak-gatekeeper: 'aud' claim and 'client_id' do not match

What is the correct way to set the aud claim to avoid the error below?

unable to verify the id token   {"error": "oidc: JWT claims invalid: invalid claims, 'aud' claim and 'client_id' do not match, aud=account, client_id=webapp"}

I kinda worked around this error message by hardcoding aud claim to be the same as my client_id. Is there any better way?

Here is my docker-compose.yml:

version: '3'
services:
  keycloak-proxy:
    image: "keycloak/keycloak-gatekeeper"
    environment:
     - PROXY_LISTEN=0.0.0.0:3000
     - PROXY_DISCOVERY_URL=http://keycloak.example.com:8181/auth/realms/realmcom
     - PROXY_CLIENT_ID=webapp
     - PROXY_CLIENT_SECRET=0b57186c-e939-48ff-aa17-cfd3e361f65e
     - PROXY_UPSTREAM_URL=http://test-server:8000
    ports:
      - "8282:3000"
    command:
      - "--verbose"
      - "--enable-refresh-tokens=true"
      - "--enable-default-deny=true"
      - "--resources=uri=/*"
      - "--enable-session-cookies=true"
      - "--encryption-key=AgXa7xRcoClDEU0ZDSH4X0XhL5Qy2Z2j"
  test-server:
    image: "test-server"

Upvotes: 50

Views: 68892

Answers (4)

rfs
rfs

Reputation: 1816

With recent keycloak version 4.6.0 the client id is apparently no longer automatically added to the audience field 'aud' of the access token. Therefore even though the login succeeds the client rejects the user. To fix this you need to configure the audience for your clients (compare doc [2]).

Configure audience in Keycloak

  • Add realm or configure existing
  • Add client my-app or use existing
  • Goto to the newly added "Client Scopes" menu [1]
    • Add Client scope 'good-service'
      • Within the settings of the 'good-service' goto Mappers tab
        • Create Protocol Mapper 'my-app-audience'
          • Name: my-app-audience
          • Choose Mapper type: Audience
          • Included Client Audience: my-app
          • Add to access token: on
  • Configure client my-app in the "Clients" menu
    • Client Scopes tab in my-app settings
      • Add available client scopes "good-service" to assigned default client scopes

If you have more than one client repeat the steps for the other clients as well and add the good-service scope. The intention behind this is to isolate client access. The issued access token will only be valid for the intended audience. This is thoroughly described in Keycloak's documentation [1,2].

Links with git tag:

Links in Keycloak respository (docu was moved):

Upvotes: 170

Bruno Telha
Bruno Telha

Reputation: 1

Its works to me:

In my SecurityConfiguration class:

@Bean
public CorsConfigurationSource corsConfigurationSource() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        
        config.setAllowCredentials(true);
        config.setAllowedOrigins(Arrays.asList("http://localhost:3000"));
        config.setAllowedMethods(Arrays.asList(CorsConfiguration.ALL));
        config.setAllowedHeaders(Arrays.asList(CorsConfiguration.ALL));
        config.setAllowCredentials(true);
        source.registerCorsConfiguration("/**", config);
        
        return source;
    }

Upvotes: -1

SvenDowideit
SvenDowideit

Reputation: 5208

If, like me, you want to automate the keycloak config, you can use kcadm

/opt/jboss/keycloak/bin/kcadm.sh \
        create clients/d3170ee6-7778-413b-8f41-31479bdb2166/protocol-mappers/models -r your-realm \
        -s name=audience-mapping \
        -s protocol=openid-connect \
        -s protocolMapper=oidc-audience-mapper \
        -s config.\"included.client.audience\"="your-audience" \
        -s config.\"access.token.claim\"="true" \
        -s config.\"id.token.claim\"="false"

Upvotes: 5

Old Pro
Old Pro

Reputation: 25557

This is due to a bug: https://issues.jboss.org/browse/KEYCLOAK-8954

There are two workarounds described in the bug report, both of which appear to do basically the same thing as the accepted answer here but can be applied to the Client Scope role, so you don't have to apply them to every client individually.

Upvotes: 16

Related Questions