Keycloak init script update : support audience (oidc-audience-mapper) protocol mappers #2667

Activity

1. vadherhemant

   assigned

   ckm007

   on Oct 8, 2026
2. Ivanmeneges

   self-assigned this

   on Oct 14, 2026
3. ckm007

   added a commit that references this issue on Oct 21, 2026

   Merge pull request #216 from mosip/Ivanmeneges-patch-2

   ...

   This issue will close once commit be56a7e is merged into the 'master' branch.

   be56a7e
4. Ivanmeneges commented on Oct 23, 2026

   

   Ivanmeneges

   on Oct 23, 2026

   Contributor

   More actions

   The Keycloak init script now supports audience mappers. The change is merged in mosip/keycloak release-1.3.x through mosip/keycloak#216 (be56a7e).

   keycloak-init/keycloak_init.py no longer hardcodes oidc-usermodel-attribute-mapper. Each client mappers entry is passed to mapper_payload:

   • Leave protocol_mapper unset, or set oidc-usermodel-attribute-mapper, to keep the existing user-attribute mapper (mapper_name, mapper_user_attribute, token_claim_name).
   • Set protocol_mapper: oidc-audience-mapper and exactly one of included_client_audience or included_custom_audience. The script sets access.token.claim to true and adds that value to the access token aud.
   • An entry with both audience fields, or any other protocol_mapper, is rejected before a realm or client is created. A re-run skips a mapper name that already exists (HTTP 409). To change an audience, delete that mapper in Keycloak and run init again.

   Example:

   - name: mosip-pms-client
     mappers:
       - mapper_name: esignet-audience
         protocol_mapper: oidc-audience-mapper
         included_client_audience: mosip-ida-client

   Tested on a fresh Keycloak in the Nexus cluster with keycloak_init.py from release-1.3.x. Init created esignet-audience on mosip-pms-client as oidc-audience-mapper with included.client.audience=mosip-ida-client and access.token.claim=true. Running init again updated the realm and clients and skipped that mapper.

   The Helm chart image tag is still mosipid/keycloak-init:1.3.0. The merge published the new script as mosipid/keycloak-init:release-1.3.x. deploy/keycloak/keycloak-init.sh installs chart 12.0.2, which uses tag 1.3.0, so that job does not pick up this change until the image tag is updated. The audience entry in helm/keycloak-init/values.yaml is a comment; add it on the client that needs it.
5. Ivanmeneges commented on Oct 26, 2026

   

   Ivanmeneges

   on Oct 26, 2026

   Contributor

   More actions

   After it was tested and worked fine raised the same changes to develop branch and below is the PR for the same
   PR: mosip/keycloak#217
6. Ivanmeneges commented on Oct 27, 2026

   

   Ivanmeneges

   on Oct 27, 2026

   Contributor

   More actions

   The PR has been merged for the same so now the request has been in place in both develop and release-1.3.x
7. Ivanmeneges

   closed this as completedon Oct 28, 2026
8. Ivanmeneges

   set

   Resolved By

   to

   Ivan

   on Oct 28, 2026