expertKeycloak, Spring Authorization Server & Microservices Security
Why doesn't a JWT token customizer (like jwtTokenCustomizer()) affect opaque tokens?
A JWT customizer runs only during the process of ENCODING a JWT at the Authorization Server — it has no relevance to opaque tokens, which are just random reference strings with no embedded, customizable claims at all. Any role/claim information for opaque tokens must instead be derived from the introspection endpoint's response structure on the resource-server side, which is a different data shape entirely.
This is a Pro chapter
Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.
Why doesn't a JWT token customizer (like jwtTokenCustomizer()) affect opaque tokens?