Subject missing in JWT with keycloak dev service after quarkus upgrade

[antoinechamot]

We just made a Quarkus upgrade. For our integration tests we use KeycloakTestClient with keycloakClient.getAccessToken(userName).
This token does not contain anymore sub so getSubject() return null. It seems to be due to a keycloak change.

Is it possible to add the basic scope in devservice ?

[sberyozkin]

@antoinechamot We haven't updated to Keycloak 26.0.1 yet...

Is it possible to add the basic scope in devservice ?

Do you mean adding something like scope=oidc%20basic in the redirect URL ?
quarkus.oidc.authentication.scopes=basic should be recognized by the devservice

[antoinechamot]

No i mean having the sub in the jwt token for default user bob when i do keycloakClient.getAccessToken("bob").
return given().auth() .oauth2(getAccessToken("bob")) .when() .get(uri);

Before quarkus upgrade we add no problem. Now the sub field has dissapeared, i know new keycloak version move this property to the basic scope assign to clients by default.
Adding quarkus.oidc.authentication.scopes=basic has no effect

[sberyozkin]

@antoinechamot Can this basic scope be set with with the Keycloak Admin API call ? Or by customizing the Keycloak start up command ?
Let us know the details and we will think what can be done

[antoinechamot]

Hum i do not really know i see the basic scope is missing in the quarkus-app client. So i guess it is in the setup that creates quarkus app client that it must be added.
In our project using keycloak admin client we simply add something like :
newClient.setDefaultClientScopes(List.of("web-origins", "profile", "roles", "microprofile-jwt", "basic")); .
But i am pretty sure you can use rest admin api after client creation if necessary

The token i get has sub missing :

{
  "exp": 1730115527,
  "iat": 1730114927,
  "jti": "6b1fe000-c83b-4ecf-b8eb-94c7f92d1597",
  "iss": "http://localhost:32880/realms/quarkus",
  "typ": "Bearer",
  "azp": "quarkus-app",
  "sid": "0e0cfbbd-6cc2-43f0-83c2-568255d8763a",
  "scope": "microprofile-jwt",
  "upn": "bob",
  "groups": [
    "admin"
  ]
}

Before the upgrade (quarkus 3.8.5) :

{
  "exp": 1730115945,
  "iat": 1730115345,
  "jti": "aa6f8e04-eeb8-4b06-a84d-f5ea059be772",
  "iss": "http://localhost:32880/realms/quarkus",
  "sub": "7e699feb-ba7b-439e-a488-e1040d020ec5",
  "typ": "Bearer",
  "azp": "quarkus-app",
  "session_state": "4fc48064-4bdd-4757-bf63-37653e45ab6e",
  "scope": "microprofile-jwt",
  "sid": "4fc48064-4bdd-4757-bf63-37653e45ab6e",
  "upn": "bob",
  "groups": [
    "admin"
  ]
}

After looking into the quarkus repo maybe in KeycloakDevServicesProcessor.java class you can simply modify the createClient method and add the basic scope with

        ClientRepresentation client = new ClientRepresentation();
        client.setClientId(clientId);
        client.setRedirectUris(List.of("*"));
        client.setPublicClient(false);
        client.setSecret(oidcClientSecret);
        client.setDirectAccessGrantsEnabled(true);
        client.setServiceAccountsEnabled(true);
        client.setImplicitFlowEnabled(true);
        client.setEnabled(true);
        client.setRedirectUris(List.of("*"));
        client.setDefaultClientScopes(List.of("microprofile-jwt","basic"));
        return client;
    }

@sberyozkin Let me know if you need more information

[sberyozkin]

Thanks @antoinechamot, that looks like it will work. The problem is, we can't upgrade to KC 26 yet (due to some dependencies being moved to a dedicated library), but I'll look into it once we do.