🐛(keycloak) map eidas1 acr value in dev realm

The backend sends acr_values=eidas1 on every authorization request
(OIDC_AUTH_REQUEST_EXTRA_PARAMS) but the dev realm had an empty
acr.loa.map, so Keycloak treated the value as an unknown essential acr
claim. Web logins survived it, but the mobile system-browser flow
(ASWebAuthenticationSession / Custom Tabs) failed the login round-trip,
breaking cross-app SSO in dev. Mapping eidas1 to LoA 1 mirrors what the
production IdP declares.
This commit is contained in:
jbpenrath
2026-07-22 11:16:42 +02:00
parent b7b5ff0604
commit 4ad0a80999
+2 -2
View File
@@ -683,7 +683,7 @@
"oidc.ciba.grant.enabled" : "false",
"backchannel.logout.session.required" : "true",
"client_credentials.use_refresh_token" : "false",
"acr.loa.map" : "{}",
"acr.loa.map" : "{\"eidas1\":1}",
"require.pushed.authorization.requests" : "false",
"display.on.consent.screen" : "false",
"client.session.idle.timeout" : "-1",
@@ -2151,7 +2151,7 @@
"parRequestUriLifespan" : "60",
"clientSessionMaxLifespan" : "0",
"frontendUrl" : "",
"acr.loa.map" : "{}",
"acr.loa.map" : "{\"eidas1\":1}",
"darkMode" : "false"
},
"keycloakVersion" : "26.2.5",