How to debug external IDP token

Björn Eickvonder

unread,

Sep 2, 2021, 10:53:02 AM9/2/21

to Keycloak User

I‘ve setup an OIDC identity provider to a customer IDP (actually it is a Keycloak as well). Now I have a problem that customer is telling me that he sets a specific claim but from my perspective it doesn’t look like they do.

What is the easiest way to debug the brokered access/id token?

Björn

Thomas Darimont

unread,

Sep 2, 2021, 11:35:04 AM9/2/21

to Björn Eickvonder, Keycloak User

Hi Björn,

depending on your IdP implementation take a look at:

- org.keycloak.protocol.oidc.DefaultTokenExchangeProvider#exchangeExternalToken

- org.keycloak.protocol.oidc.DefaultTokenExchangeProvider#importUserFromExternalIdentity

The BrokeredIdentityContext encapuslates the information provided by the external IdP (backed by an OIDC IDToken, UserInfo etc.).

Cheers,

Thomas

--
You received this message because you are subscribed to the Google Groups "Keycloak User" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keycloak-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/keycloak-user/94243816-7818-497a-8687-53a8a5643b07n%40googlegroups.com.

Niko Köbler

unread,

Sep 3, 2021, 1:50:54 AM9/3/21

to Keycloak User

You can also store the external tokens and retrieve them after authentication, like mentioned here in the docs: https://www.keycloak.org/docs/latest/server_admin/index.html#retrieving-external-idp-tokens

- Niko

Björn Eickvonder

unread,

Sep 3, 2021, 8:41:22 AM9/3/21

to Keycloak User

Hi Niko,

thanks store external tokens works great for me.

Björn

Reply all

Reply to author

Forward