Configure Keycloak to include an at_hash claim in the id token

Question

I'm currently using Keycloak 9.0.0. When authenticating using the code flow and exchanging this code, I'm receiving an id token without the at_hash claim.

How do I configure Keycloak to include an at_hash claim in the id token?

Background:

I'm using a "classic" server side rendered (SSR) program, a confidential client. I'm sending requests to my local http api. But I also have an Angular client. The SSR is a Go programm using github.com/coreos/go-oidc. Rendered pages that require authentication redirect the visitor to keycloak and back via the redirect_uri. Since the visitor is logged in its id token is present in the session and I also pass the access token. However the id token has no at_hash claim and thus access token validation fails.

I also have a mobile web version of this site, in Angular and it sends a bearer access token once logged in. This app uses the code flow + pcke.

Both should be able to send authenticated requests, but since I'm using pretty much the only oidc client library for Go available, it requires an at_hash claim being present in the id token to be able to verify access tokens. The package currently has no support for the introspection endpoint.

Both id token and access token are returned from the IDP. But neither has an at_hash claim.

Answer 1

According to OIDC at_hash is mandatory only when access token is issued. Make sure you are using response_type=id_token token and not response_type=id_token.