Repository navigation
Experimental Support issuing Identity Assertion JWT Authorization Grant (ID-JAG) #48818
Description
Description
This issue proposes adding support for Keycloak to act as an Issuer of the Identity Assertion JWT Authorization Grant (ID-JAG).
While issue #43971 focuses on Keycloak acting as a Consumer (accepting an ID-JAG to issue an access token), this issue addresses the generation side of the flow. In an enterprise environment, when Keycloak is used as the corporate Identity Provider (IdP), clients must be able to obtain an ID-JAG directly from Keycloak. ...The client can then present this ID-JAG to an external SaaS service's authorization server to obtain an access token.
To fully support the ID-JAG ecosystem, Keycloak needs the capability to mint and issue these specific Identity Assertion JWTs in compliance with the relevant profiles (such as the MCP Authorization specification / SEP-646).
Value Proposition
Enables Keycloak to function as a complete Corporate IdP in the ID-JAG flow, allowing clients to seamlessly request ID-JAGs that can be used across SaaS boundaries. This complements #43971 to provide an end-to-end ID-JAG solution.
Goals
- Add support for Keycloak to generate and issue ID-JAG (Identity Assertion JWT).
- Implement the token issuance mechanism (e.g., via OAuth 2.0 Token Exchange RFC 8693 with a specific
requested_token_typefor ID-JAG). - Provide necessary client or realm configuration options to control the issuance of ID-JAG, including audience mapping and required custom claims.
- Ensure the issued tokens strictly comply with the ID-JAG profile specifications.
Non-Goals
- ...Consuming ID-JAG to issue access tokens (This is already covered by Identity Assertion JWT Authorization Grant #43971).
Discussion
No response
Notes
No response
Activity
bkoragan commentedon Jun 24, 2026
@bucchi Here is the PR# #50288 changes to support the request, please help review and share feedback, attached the detailed steps and aligns with MCPContext protocol approach.
https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization#how-it-works
modelcontextprotocol/conformance#110
bucchi commentedon Jun 25, 2026
Hello @bkoragan,
You are the one sent me DM in Slack about three hours ago, right?
About your PR(#50288) and the comment you gave me above:
First and foremost, I would like to continue working on my existing PR and push it toward getting merged.
I have been involved in the implementation of ID-JAG in Keycloak since long before it gained its current level of attention, so I believe I can strongly contribute to this effort with my deep understanding of the specifications.
Secondly, I have a question:
is there any specific problem with my PR? I would like to understand the intention behind opening a separate PR. Since you previously left review comments on my PR, you must have been fully aware of its existence.
My original intention was to open the PR, actively gather feedback from the community, and iteratively improve the source code to get it merged.(I guess it is pretty normal.) Could there be any issue with my approach?
mposolda commentedon Jun 25, 2026
@bucchi +1 to your points. I've closed the other PR #50288 .
bkoragan commentedon Jun 25, 2026
@bucchi I appreciate the work you’ve been doing on ID-JAG and the depth of understanding you’ve built around the specification. Let me clear this up, because I think it came across the wrong way. There was an ask over email/slack to help get the ID-JAG issuer feature into an upcoming Keycloak release..I also want to acknowledge that I was aware of your PR and the ongoing work in that area. My intention in opening my PR was not to replace or compete with your work, but rather to contribute an implementation with working code, tests, and documentation so that we could evaluate concrete approaches and help move the feature forward to help community.. I'm happy to collaborate and help in anyway as required. Thanks.
https://cloud-native.slack.com/archives/C09CGDKPTSQ/p1782270086201639?thread_ts=1771504128.722829&cid=C09CGDKPTSQ
christian-posta commentedon Jul 6, 2026
What's the status of this? Will it be moving forward? Would it be in one of the next releases of Keycloak?
VinodAnandan commentedon Sep 14, 2026
@bucchi @tnorimat @mposolda @graziang : As you may have seen, there has been significant interest from the Keycloak community in both the issue and the PR. It would be greatly appreciated if you could share an update when you get a chance, particularly regarding whether you are planning (or if you can) to include this feature/PR in the 26.8 release, which is scheduled for roughly two weeks from now.
Any update/plan on the current status and expected timeline would be very helpful.