Validate the Token Claims

Obtain an end-user token and a database-access token from Keycloak, then validate their claims before configuring the database.

Verify the following:

• Both tokens: The iss claim matches the realm issuer, and the expiration time specified by exp has not passed. Verify each token’s signature using the public key from the realm’s JWKS endpoint. The JWT header’s kid identifies the signing key.

• End-user token: The aud claim includes ords_client, the preferred_username claim identifies the user, and the sub claim contains the unique user identifier. The top-level roles array contains the user’s realm roles, such as EMPLOYEE.

• Database-access token: The aud claim includes db_app, and client_id contains ords_client. The sub claim identifies the service account and can differ from the client ID.

To preview the claims generated by your client configuration, see Client scopes evaluation in the Keycloak Server Administration Guide.

After validating the tokens, configure the database as described in Set Up IAM Integration for Application-Mediated Connections.