Change Details

The auth_time is not always provided depending on the authentication flow used. The field iat provides the same information and is always delivered. Related to T2858 [1] Related to P975 [2] https://github.com/keycloak/keycloak-documentation/blob/master/server_development/topics/action-token-spi.adoc#anatomy-of-action-token

The auth_time is not always provided depending on the authentication flow used. The field iat is provided for example in the direct grant access flow so use it instead as fallback. Related to T2858 [1] Related to P975 [2] https://github.com/keycloak/keycloak-documentation/blob/master/server_development/topics/action-token-spi.adoc#anatomy-of-action-token

The auth_time is not always provided depending on the authentication flow used. The field iat is provides the samd for example information and is always delivered the direct grant access flow so use it instead as fallback. Related to T2858 [1] Related to P975 [2] https://github.com/keycloak/keycloak-documentation/blob/master/server_development/topics/action-token-spi.adoc#anatomy-of-action-token