expertKeycloak, Spring Authorization Server & Microservices Security
Why doesn't a JWT token customizer (like jwtTokenCustomizer()) affect opaque tokens?
A JWT customizer runs only during the process of ENCODING a JWT at the Authorization Server — it has no relevance to opaque tokens, which are just random reference strings with no embedded, customizable claims at all. Any role/claim information for opaque tokens must instead be derived from the introspection endpoint's response structure on the resource-server side, which is a different data shape entirely.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response