Validated Audiences do not match Client Token

[regilero]

The audience management for access tokens has changed.

You can check this other discussion:

Audience validation failed with Keycloak 8.x in Owin.Security.Keycloak .Net library

The newer versions of Keycloak server has changed how the audience claim (“aud”) is set in the access token. The library (Owin.Security.Keycloak) assumes that the Keycloak Client ID is in the “aud” claim, which no longer is the case by default. One way to fix it is in Keycloak admin UI, add a mapper in to the Keycloak Client that’s being used. Name: Audience Mapper type: Audience Included Client Audience: [Client ID] Also, make sure the .NET library is configured with option DisableAllRefre…

I also made a bug report with some infos on that: Breaking change in 'aud' audience content for access tokens · Issue #12415 · keycloak/keycloak · GitHub