Content Comparison

...

The default access token structure builds on Keycloack Keycloak and consists of the following three parts:

...

The claims in the Access token is outlined in the table below. The origin column indicates non-standard claims. Such claims are either added by Keycloack Keycloak or the result of customization made by the BankID OIDC Provider.

Claim	Origin	Scope	Example	Description	Comment
General part
`typ`	KeycloackKeycloak	none required	`Bearer`	Token type	Always `Bearer` for Access Tokens
`allowed-origins`	KeycloackKeycloak	none required	[ ]	Not in use by the OIDC Provider from BankID
ID part
`acr`	Standard	none required	`4`	See ID Token
`amr`	Standard	none required	`BID`	See ID Token
`auth_time`	Standard	none required	`1510497762`	See ID Token
`azp`	Standard	none required	`oidc_testclient`	See ID Token
`bankid_altsub`	Custom	none required	`9578-5999-4-1765512`	See ID Token
`exp`	Standard	none required	`1510498063`	See session handling
`iat`	Standard	none required	`1510497763`	See session handling
`iss`	Standard	none required	`<oidc-baseurl>`	See ID Token
`jti`	Standard	none required	`7f22fd6a-3d46-4d5a-ae56-6de3c53e1873`	See ID Token
`nbf`	Standard	none required	`0`	See ID Token
`nonce`	Standard	none required	`<random value>`	See ID Token
`session_state`	KeycloackKeycloak	none required	`abf823c2-9810-4133-9369-7bff1223d6c1`	See ID Token
`sub`	Standard	none required	`e8c523ff-52a2-42e2-a7a5-f1d0fbb76204`	See ID Token
`birthdate`	Standard	none required	`1966-12-18`	See ID Token
`family_name`	Standard	`profile`	`Nilsen`	See ID Token
`given_name`	Standard	`profile`	`Frode Beckmann`	See ID Token
`name`	Standard	`profile`	`Nilsen, Frode Beckmann`	See ID Token
`preferred_username`	Standard	`profile`	`Nilsen, Frode Beckmann`	See ID Token
Access part
`aud`	Standard	none required	`tinfo`	Audience	List of VAS-names for which the access token in question is intended
`realm_access`	KeycloackKeycloak	`profile` `address` `phone` `email nnin_altsub` `nnin`	`{"roles:` `["profile","address","phone","email","nnin_altsub","nnin"]` `}`	Resource access designator at the OIDC platform level.
`resource_access`	KeycloackKeycloak	`profile` `address` `phone` `email` `nnin`	{"tinfo: {"roles ["address","phone_number", "email", "nnin"] }}	Resource access designator.

...

Version	Old Version 9	New Version 10
Changes made by	Janny Kinende	Janny Kinende
Saved on	18 Aug 2021	21 Jun 2022

Content Comparison

Versions Compared

Key