Description

For Keycloak to fully comply with FAPI 2.0 Security Profile Final, Keycloak needs to do as follows:

According to the item 8 of section 5.3.2.1 of FAPI 2.0 Security Profile Final specification,

• On receiving a client authentication assertion from a client, Keycloak only accept its issuer identifier value as a string in the aud claim received in the client authentication assertion.
• the issuer value is equal to the issuer claim value of the server metadata that the client can obtain by accessing well-known URI.

Discussion

No response

Motivation

Making Keycloak fully comply with FAPI 2.0 Security Profile Final specification.

Details

No response