Change Details

At least when using direct grant connect flow [1], the `auth_time` is not present in the decoded_token. Which fails the conversion to OIDCUser. The "iat" key is provided though so fallback to use it [2] Related to T2858 [1] Related to P975 [2] https://github.com/keycloak/keycloak-documentation/blob/master/server_development/topics/action-token-spi.adoc#anatomy-of-action-token

The auth_time is not always provided depending on the authentication flow used. The field iat provides the same information and is always delivered. Related to T2858 [1] Related to P975 [2] https://github.com/keycloak/keycloak-documentation/blob/master/server_development/topics/action-token-spi.adoc#anatomy-of-action-token

At least when using direct grant connectThe auth_time is not always provided depending on the authentication flow [1],used. the `auth_time` is not present in the decoded_token.The Which fails the conversion to OIDCUser. The "iat" key is provided though so fallback to use it [2]field iat provides the same information and is always delivered. Related to T2858 [1] Related to P975 [2] https://github.com/keycloak/keycloak-documentation/blob/master/server_development/topics/action-token-spi.adoc#anatomy-of-action-token