Make sure that there is single audience allowed by default in JWT tokens sent to client authentication #38819
Description
Description
There are changes in the OIDC specification, which try to make sure that validation of the audience is more strict during the client authentication with JWT tokens. More context about this is in this issue: #38751 .
As a first for Keycloak 26.2 we would do:
- Make sure that JWT client authentication allows only single audience being in the JWT token by default.
- There would be single option at the server level, which will allow to have this check to be less strict and allow multiple audiences in the JWT token. But this option would be disabled by default
- We will document that in the Keycloak 26.2 release notes and upgrading guide. With the note that option would be probably removed in Keycloak 27
Discussion
#38754 (It is the PR, but contains some discussion)
Motivation
No response
Details
No response