Subject missing in JWT with keycloak dev service after quarkus upgrade

[antoinechamot]

We just made a Quarkus upgrade. For our integration tests we use KeycloakTestClient with keycloakClient.getAccessToken(userName).
This token does not contain anymore sub so getSubject() return null. It seems to be due to a keycloak change.

Is it possible to add the basic scope in devservice ?

[sberyozkin]

@antoinechamot We haven't updated to Keycloak 26.0.1 yet...

Is it possible to add the basic scope in devservice ?

Do you mean adding something like scope=oidc%20basic in the redirect URL ?
quarkus.oidc.authentication.scopes=basic should be recognized by the devservice

[sberyozkin]

Thanks @antoinechamot, that looks like it will work. The problem is, we can't upgrade to KC 26 yet (due to some dependencies being moved to a dedicated library), but I'll look into it once we do.

[sberyozkin]

@antoinechamot Hi, we've just upgraded to Keycloak 26.0.7, and I see sub in both access and ID tokens issued by Keycloak devservice

[stephan-strate]

We have just updated to Quarkus 3.18 and therefore Keycloak 26.0.7, but the jwt sub is still null.
Do we need to add basic scope to KeycloakDevServicesProcessor.java now? Doing that manually works

[stephan-strate]

I have prepared this pull request: #46339

[tomatte]

This thread helped me solve my problem where the sub was also missing from the jwt token, to solve it I did the following:

In Keykloak go to Client Scopes -> Create client scope -> I gave the name of "sub" and toggled to on the "Include in token scope" -> Save -> Mappers -> Add predefined mappers -> sub (search for sub and select it) -> Add

Then go to Clients (select your client) -> Client scopes -> Add client scopes -> sub (select the sub scope) -> Add

Now you need to logout and login so the new token will have the sub in it