# Getting advice **URL:** https://forum.keycloak.org/c/getting-advice/8.md [Latest](https://forum.keycloak.org/latest.md) · [Categories](https://forum.keycloak.org/categories.md) · [Tags](https://forum.keycloak.org/tags.md) --- ## [About the Getting advice category](https://forum.keycloak.org/t/about-the-getting-advice-category/22)
**Author:** [@sblanc](https://forum.keycloak.org/u/sblanc)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 6:19pm UTC](https://forum.keycloak.org/t/about-the-getting-advice-category/22 "2021-12-10T18:19:09Z")
Asking for advice on how to solve your use-cases and best practices. --- ## [Keycloak 26.7.1 rejecting request from Claude](https://forum.keycloak.org/t/keycloak-26-7-1-rejecting-request-from-claude/31660)
**Author:** [@nlaskhmi](https://forum.keycloak.org/u/nlaskhmi)\ **Replies:** 1\ **Last updated:** [September 1, 2026, 2:35pm UTC](https://forum.keycloak.org/t/keycloak-26-7-1-rejecting-request-from-claude/31660 "2026-09-01T14:35:00Z")
Hello Team, I work for Simplicontract Technologies. We use Keycloak as our IDP. We were on 23, but now we want to integrate external MCP clients like Claude Desktop, Copilot, Cursor with our MCP server. We have upgraded… --- ## [How to override AssertionConsumerServiceURL in SAML AuthnRequest when Keycloak acts as SP (Identity Broker)?](https://forum.keycloak.org/t/how-to-override-assertionconsumerserviceurl-in-saml-authnrequest-when-keycloak-acts-as-sp-identity-broker/31298)
**Author:** [@sumeetpri](https://forum.keycloak.org/u/sumeetpri)\ **Replies:** 1\ **Last updated:** [August 20, 2026, 7:57am UTC](https://forum.keycloak.org/t/how-to-override-assertionconsumerserviceurl-in-saml-authnrequest-when-keycloak-acts-as-sp-identity-broker/31298 "2026-08-20T07:57:08Z")
Context We are migrating an existing SAML Service Provider (SP) application to Keycloak, where Keycloak will act as an SP and broker authentication to multiple external customer Identity Providers (IdPs). To ensure ze… --- ## [Configuring/federating user and groups from AD Ldap](https://forum.keycloak.org/t/configuring-federating-user-and-groups-from-ad-ldap/31655)
**Author:** [@tochin](https://forum.keycloak.org/u/tochin)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 3:17pm UTC](https://forum.keycloak.org/t/configuring-federating-user-and-groups-from-ad-ldap/31655 "2026-08-18T15:17:48Z")
We are attempting to federate users and groups from AD LDAP into Keycloak. We do not want to maintain a live connection to LDAP so we are using a Sync Mode of Import. We ideally would like the entire LDAP tree to be st… --- ## [Key-Cache trigger/refresh](https://forum.keycloak.org/t/key-cache-trigger-refresh/31654)
**Author:** [@VincentS](https://forum.keycloak.org/u/VincentS)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 2:23pm UTC](https://forum.keycloak.org/t/key-cache-trigger-refresh/31654 "2026-08-18T14:23:00Z")
Hello, Currently i am building a Keycloak IDP with ~180 connected clients for which i’m using Metadata Descriptor URL. I am looking for a way to refresh/trigger the metadata. Because if something changes in the metadata… --- ## [Groupmembership are not visible anymore at Keycloak UI after upgrade from version 26.6.4 to 26.7.0](https://forum.keycloak.org/t/groupmembership-are-not-visible-anymore-at-keycloak-ui-after-upgrade-from-version-26-6-4-to-26-7-0/31642)
**Author:** [@norbert.pourie](https://forum.keycloak.org/u/norbert.pourie)\ **Replies:** 2\ **Last updated:** [August 6, 2026, 10:17am UTC](https://forum.keycloak.org/t/groupmembership-are-not-visible-anymore-at-keycloak-ui-after-upgrade-from-version-26-6-4-to-26-7-0/31642 "2026-08-06T10:17:17Z")
We upgraded from Keycloak version 26.6.4 to 26.7.0 and recognized that now the groupmembership imported from AD via LDAP-Föderation is not showing up anymore at Keycloak UI at the groups membership tab. The membership at… --- ## [{“errorMessage”:”Bad Request”} when using admin api](https://forum.keycloak.org/t/errormessage-bad-request-when-using-admin-api/31599)
**Author:** [@Bily-SX](https://forum.keycloak.org/u/Bily-SX)\ **Replies:** 0\ **Last updated:** [July 16, 2026, 2:46am UTC](https://forum.keycloak.org/t/errormessage-bad-request-when-using-admin-api/31599 "2026-07-16T02:46:34Z")
I am trying to use the admin api to update user info but when the api is called it returns this error: {StatusCode: 400, ReasonPhrase: 'Bad Request'} PUT /admin/realms/{realm}/users/{user-id} The weird part is that wh… --- ## [Best practice for multi-user-type access: single realm vs. multiple realms?](https://forum.keycloak.org/t/best-practice-for-multi-user-type-access-single-realm-vs-multiple-realms/31355)
**Author:** [@pdany1116](https://forum.keycloak.org/u/pdany1116)\ **Replies:** 3\ **Last updated:** [July 4, 2026, 2:42pm UTC](https://forum.keycloak.org/t/best-practice-for-multi-user-type-access-single-realm-vs-multiple-realms/31355 "2026-07-04T14:42:56Z")
Hi all, I’m evaluating Keycloak as the central IdP for our organization and looking for guidance on how to architect user and access separation across different application types. User types Our organization has three… --- ## [Passkey logins don't last long](https://forum.keycloak.org/t/passkey-logins-dont-last-long/31581)
**Author:** [@hmof](https://forum.keycloak.org/u/hmof)\ **Replies:** 1\ **Last updated:** [July 1, 2026, 6:43am UTC](https://forum.keycloak.org/t/passkey-logins-dont-last-long/31581 "2026-07-01T06:43:15Z")
I’ve upgraded my existing realm to the latest browser authentication flow in order to login with a passkey, passwordless. However, I seem to have to login multiple times per day now. When I login with a password and “re… --- ## [How to troubleshoot 'SSLHandshakeFailed' when trying to connect to LDAP](https://forum.keycloak.org/t/how-to-troubleshoot-sslhandshakefailed-when-trying-to-connect-to-ldap/31270)
**Author:** [@joost](https://forum.keycloak.org/u/joost)\ **Replies:** 6\ **Last updated:** [June 16, 2026, 6:19pm UTC](https://forum.keycloak.org/t/how-to-troubleshoot-sslhandshakefailed-when-trying-to-connect-to-ldap/31270 "2026-06-16T18:19:22Z")
Hi all, Since last weekend, ldap users, from a specific “user federation” had their login denied. Presumably because of security update of our OpenSSL. OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) … --- ## [Client not allowed to exchange](https://forum.keycloak.org/t/client-not-allowed-to-exchange/31410)
**Author:** [@anderson-gusmao](https://forum.keycloak.org/u/anderson-gusmao)\ **Replies:** 2\ **Last updated:** [June 14, 2026, 10:49pm UTC](https://forum.keycloak.org/t/client-not-allowed-to-exchange/31410 "2026-06-14T22:49:31Z")
Hello everyone, I need some help understanding how token exchange works in Keycloak. I’ve spent several hours trying to solve an issue and would appreciate any guidance. I’m running Keycloak 26.6.3. One thing that has… --- ## [Regex in OIDC redirect URI](https://forum.keycloak.org/t/regex-in-oidc-redirect-uri/31390)
**Author:** [@manavgupta](https://forum.keycloak.org/u/manavgupta)\ **Replies:** 1\ **Last updated:** [June 3, 2026, 11:46am UTC](https://forum.keycloak.org/t/regex-in-oidc-redirect-uri/31390 "2026-06-03T11:46:56Z")
Currently keycloak only supports wildcards for the redirectURI, which hands down is insecure as-it-is. Is there a way to add a regex(I know it’s not officially supported, but has anyone tried a workaround for that). Any … --- ## [OIDC Identity Provider (ADFS): scope not sent in token exchange request, groups claim missing](https://forum.keycloak.org/t/oidc-identity-provider-adfs-scope-not-sent-in-token-exchange-request-groups-claim-missing/31387)
**Author:** [@Kaushik](https://forum.keycloak.org/u/Kaushik)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 5:01pm UTC](https://forum.keycloak.org/t/oidc-identity-provider-adfs-scope-not-sent-in-token-exchange-request-groups-claim-missing/31387 "2026-05-28T17:01:31Z")
Environment: Keycloak 26.2.4 (Quarkus), Oracle DB, ADFS as OIDC Identity Provider Issue 1: Scope not included in token exchange POST request We have Keycloak brokering authentication to Microsoft ADFS via OIDC. ADFS re… --- ## [Recommended way to impersonate a user and add impersonator\_uuid claim?](https://forum.keycloak.org/t/recommended-way-to-impersonate-a-user-and-add-impersonator-uuid-claim/31386)
**Author:** [@pesseyjulien](https://forum.keycloak.org/u/pesseyjulien)\ **Replies:** 1\ **Last updated:** [May 28, 2026, 2:07pm UTC](https://forum.keycloak.org/t/recommended-way-to-impersonate-a-user-and-add-impersonator-uuid-claim/31386 "2026-05-28T14:07:29Z")
Hello, I currently use a custom Keycloak endpoint to generate an access token for a target user and add a custom claim: impersonator\_uuid I would like to replace this custom endpoint with a Keycloak-native solution. T… --- ## [Conditional sub-flows not respecting user attribute condition](https://forum.keycloak.org/t/conditional-sub-flows-not-respecting-user-attribute-condition/31385)
**Author:** [@William](https://forum.keycloak.org/u/William)\ **Replies:** 0\ **Last updated:** [May 26, 2026, 8:14pm UTC](https://forum.keycloak.org/t/conditional-sub-flows-not-respecting-user-attribute-condition/31385 "2026-05-26T20:14:40Z")
I’m building a multi-MFA flow in Keycloak 26.5.1 where users can be assigned one of three MFA methods: SMS, Email OTP, or TOTP. The method is stored as a user attribute mfa\_option with values SMS, Email, or TOTP. Curren… --- ## [Test User being unexpectedly disabled with error "user\_disabled"](https://forum.keycloak.org/t/test-user-being-unexpectedly-disabled-with-error-user-disabled/31376)
**Author:** [@andyspoon](https://forum.keycloak.org/u/andyspoon)\ **Replies:** 0\ **Last updated:** [May 20, 2026, 4:53pm UTC](https://forum.keycloak.org/t/test-user-being-unexpectedly-disabled-with-error-user-disabled/31376 "2026-05-20T16:53:01Z")
Hi all. Our web app uses KeyCloak 26.3.2 and we run smoke tests against the app. These smoke tests use the same user each time via a GitHub action. Sometimes the user gets Disabled but I don’t understand why. In the use… --- ## [External-to-Internal token exchange](https://forum.keycloak.org/t/external-to-internal-token-exchange/31373)
**Author:** [@GuntherF](https://forum.keycloak.org/u/GuntherF)\ **Replies:** 1\ **Last updated:** [May 18, 2026, 7:38pm UTC](https://forum.keycloak.org/t/external-to-internal-token-exchange/31373 "2026-05-18T19:38:28Z")
Is the below statement accurate? And if so, how can we mitigate the maintainability risks relying on legacy features if Keycloak potentially deprecates them? Will support for external-to-internal token exhange be part of… --- ## [External-to-Internal Token Exchange Best Practices in v26.x: JWT Authorization Grant and Entra ID aud Claim](https://forum.keycloak.org/t/external-to-internal-token-exchange-best-practices-in-v26-x-jwt-authorization-grant-and-entra-id-aud-claim/31331)
**Author:** [@mjammal](https://forum.keycloak.org/u/mjammal)\ **Replies:** 1\ **Last updated:** [May 15, 2026, 9:42am UTC](https://forum.keycloak.org/t/external-to-internal-token-exchange-best-practices-in-v26-x-jwt-authorization-grant-and-entra-id-aud-claim/31331 "2026-05-15T09:42:54Z")
Hello, We are seeking guidance on the recommended approach for External-to-Internal Token Exchange in Keycloak v26.6.5. Our Scenario Architecture: Our application is embedded in an iframe by a third-party application. … --- ## [Reset credentials (password + OTP) stuck in a loop](https://forum.keycloak.org/t/reset-credentials-password-otp-stuck-in-a-loop/30274)
**Author:** [@REX500](https://forum.keycloak.org/u/REX500)\ **Replies:** 2\ **Last updated:** [May 14, 2026, 12:43pm UTC](https://forum.keycloak.org/t/reset-credentials-password-otp-stuck-in-a-loop/30274 "2026-05-14T12:43:04Z")
Asking as I couldn’t find a proper answer in existing threads. I am running a clean Keycloak v.26.2.5 server. I haven’t touched existing authentication flows, especially the reset credentials flow - it’s vanilla i.e. i… --- ## [Should lightweight access tokens always be introspected?](https://forum.keycloak.org/t/should-lightweight-access-tokens-always-be-introspected/31363)
**Author:** [@danilopiazza](https://forum.keycloak.org/u/danilopiazza)\ **Replies:** 6\ **Last updated:** [May 13, 2026, 8:43am UTC](https://forum.keycloak.org/t/should-lightweight-access-tokens-always-be-introspected/31363 "2026-05-13T08:43:50Z")
Are lightweight access tokens meant to be always sent to the introspection endpoint, or is it okay to validate them offline? My understanding is that checking their public key and their iat, exp, iss, and azp claims is … --- ## [For countries like Kenya sign up/in flow with just Phone number and sent OTP](https://forum.keycloak.org/t/for-countries-like-kenya-sign-up-in-flow-with-just-phone-number-and-sent-otp/31362)
**Author:** [@olal](https://forum.keycloak.org/u/olal)\ **Replies:** 3\ **Last updated:** [May 12, 2026, 9:21am UTC](https://forum.keycloak.org/t/for-countries-like-kenya-sign-up-in-flow-with-just-phone-number-and-sent-otp/31362 "2026-05-12T09:21:35Z")
As an option there should exist sign up/in with just the phone number and get the authentication token ? --- ## [Rotating DB Connection credentials using AWS Secret Manager](https://forum.keycloak.org/t/rotating-db-connection-credentials-using-aws-secret-manager/20452)
**Author:** [@Dingo](https://forum.keycloak.org/u/Dingo)\ **Replies:** 1\ **Last updated:** [May 12, 2026, 9:14am UTC](https://forum.keycloak.org/t/rotating-db-connection-credentials-using-aws-secret-manager/20452 "2026-05-12T09:14:46Z")
I am trying to utilise AWS Secrets Manager to generate and automatically rotate secrets for my DB credentials (password). From my research, it looks like one option is that the container running KeyCloak will need to be… --- ## [How do I get UserId from Keycloak using ASP.NET Web Api?](https://forum.keycloak.org/t/how-do-i-get-userid-from-keycloak-using-asp-net-web-api/31360)
**Author:** [@newUsr](https://forum.keycloak.org/u/newUsr)\ **Replies:** 1\ **Last updated:** [May 12, 2026, 9:04am UTC](https://forum.keycloak.org/t/how-do-i-get-userid-from-keycloak-using-asp-net-web-api/31360 "2026-05-12T09:04:44Z")
Currently I’m working on pet project. I’ve already done configuring to Angular + ASP.NET Project. But I tried search for information on the internet, nothing but configuring your project to your realm and client-scopes,… --- ## [Special extended access](https://forum.keycloak.org/t/special-extended-access/31361)
**Author:** [@Axel](https://forum.keycloak.org/u/Axel)\ **Replies:** 0\ **Last updated:** [May 11, 2026, 11:04am UTC](https://forum.keycloak.org/t/special-extended-access/31361 "2026-05-11T11:04:09Z")
Hello reader, I am running into two issues at the moment and have tried everything I know. MAIN GOAL: Give extended access to our main dashboard to special partners of ours. Normal access should grant 1 day sessions, ac… --- ## [Tools or approaches for Keycloak DML Changes](https://forum.keycloak.org/t/tools-or-approaches-for-keycloak-dml-changes/29663)
**Author:** [@darkoandreev](https://forum.keycloak.org/u/darkoandreev)\ **Replies:** 4\ **Last updated:** [May 4, 2026, 2:10pm UTC](https://forum.keycloak.org/t/tools-or-approaches-for-keycloak-dml-changes/29663 "2026-05-04T14:10:10Z")
Hello everyone, I have the following case and question, and I would greatly appreciate your insights regarding best practices, guides, or any other relevant resources. Let’s imagine the following scenario: we have a wo… --- ## [Configuration as code and registration workflows](https://forum.keycloak.org/t/configuration-as-code-and-registration-workflows/23581)
**Author:** [@smaly](https://forum.keycloak.org/u/smaly)\ **Replies:** 3\ **Last updated:** [May 4, 2026, 2:05pm UTC](https://forum.keycloak.org/t/configuration-as-code-and-registration-workflows/23581 "2026-05-04T14:05:40Z")
I attended a workshop at WJAX 2023 with dasniko in Munich and learned some first steps in working with keycloak. Now I have two more questions since we are currently thinking about using keycloak in the future. Is confi… --- ## [Access token with introspection vs. ID token with manual inspection](https://forum.keycloak.org/t/access-token-with-introspection-vs-id-token-with-manual-inspection/31354)
**Author:** [@danilopiazza](https://forum.keycloak.org/u/danilopiazza)\ **Replies:** 1\ **Last updated:** [May 4, 2026, 9:07am UTC](https://forum.keycloak.org/t/access-token-with-introspection-vs-id-token-with-manual-inspection/31354 "2026-05-04T09:07:44Z")
My application (let’s call it “A”) is relying on Keycloak for authentication with OIDC, and everything works fine. Now, from A (on the back-end side), I need to call another application (called “B”) and I’d like to inte… --- ## [What is the best way to auto assign a group to a user?](https://forum.keycloak.org/t/what-is-the-best-way-to-auto-assign-a-group-to-a-user/31345)
**Author:** [@vdjango](https://forum.keycloak.org/u/vdjango)\ **Replies:** 0\ **Last updated:** [April 27, 2026, 4:23pm UTC](https://forum.keycloak.org/t/what-is-the-best-way-to-auto-assign-a-group-to-a-user/31345 "2026-04-27T16:23:04Z")
Hi, I would like users that just filled a registration form to be assigned automatically to different groups. In a perfect world it would look like this : async sendRegistrationMail( mailAdress, assignedGroup ) User w… --- ## [Keycloak export failed](https://forum.keycloak.org/t/keycloak-export-failed/31339)
**Author:** [@ingo](https://forum.keycloak.org/u/ingo)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 11:15am UTC](https://forum.keycloak.org/t/keycloak-export-failed/31339 "2026-04-22T11:15:57Z")
With Keycloak Version 26.6.0 the export of a realm not master failed with 2026-04-22 11:34:04,010 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: Failed to start server in (nonserver) m… --- ## [Looking for advice on Keycloak token storage strategy](https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337)
**Author:** [@nickp](https://forum.keycloak.org/u/nickp)\ **Replies:** 0\ **Last updated:** [April 21, 2026, 9:50am UTC](https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337 "2026-04-21T09:50:44Z")
Hello everyone, I’m trying to figure out the right token handling approach for Keycloak + Next.js + FastAPI. This is not a pure SPA, and in the main flow, requests to FastAPI are mostly made server-side. Because of th… [Next page](https://forum.keycloak.org/c/getting-advice/8.md?page=1)