generic-oidc-downstream-session-binding

To bind OIDC sessions without Entra-specific claims, you validate principal issuer and client identity claims against configured authority settings. This approach enables secure multi-tenant isolation for generic providers like Keycloak.

Prism downstream sessions fail for generic OIDC providers because they lack Entra-specific tenant ID claims. This mismatch prevents correct user session mapping during multi-tenant authentication.

You configure multi-tenant isolation in Umbraco by applying generic OIDC downstream session binding logic to your PrismContext implementation. This validates issuer and audience claims for your specific Keycloak provider.

Yes, you can use generic OIDC downstream session binding for non-Entra providers. It enables provider-agnostic tenant isolation by validating issuer and client identity claims instead of relying on Entra-specific metadata.

For Prism authorization pipeline audience validation, you need to implement issuer normalization and audience validation within the pipeline. This ensures downstream sessions are securely bound to the correct Prism tenants.