skills.rest
jonnymuir
jonnymuirCOMMUNITY
Explore all skills by this author →
Website𝕏@jonnymooGitHub

keycloak-refresh-scope

Manage OIDC scope parameters for Keycloak authentication flows in ASP.NET Core.

1|Updated Dec 23, 2025
Search Tags:#authentication#identity#oidc#oauth2#keycloak#refresh-token
One-click install
npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill keycloak-refresh-scope
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: keycloak-refresh-scope
Source: https://github.com/jonnymuir/Umbraco.Prism/tree/main/.claude/skills/keycloak-refresh-scope
Command: npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill keycloak-refresh-scope

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill resolves authentication failures caused by incorrectly applying Entra-specific OIDC scopes to generic Keycloak identity providers, specifically regarding offline-token requests.

Core Features & Use Cases

  • Scope Differentiation: Distinguishes between standard session refresh tokens and Keycloak offline-token requests.
  • Configuration Guardrails: Prevents production deployments from accidentally requesting long-lived offline tokens.
  • Use Case: When integrating a multi-tenant ASP.NET Core application with both Entra and Keycloak, use this logic to ensure the correct scope parameters are sent during the token refresh flow to avoid 400 Bad Request errors.

Quick Start

Apply the keycloak-refresh-scope logic to your OIDC configuration by ensuring your refresh token request omits the scope parameter when an offline_access token is already bound to the session.

Frequently Asked Questions about keycloak-refresh-scope

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why does my Keycloak OIDC refresh token request return a 400 Bad Request error?▼

A 400 Bad Request error during Keycloak OIDC refresh token requests often occurs when Entra-specific OIDC scope parameters are incorrectly applied to generic Keycloak identity providers, necessitating scope parameter omission for offline_access tokens.

How do I differentiate OIDC scopes for offline-token requests in a multi-tenant ASP.NET Core application?▼

Differentiate OIDC scopes by omitting the scope parameter during the refresh token request when an offline_access token is already bound to the session, preventing long-lived offline-token grants in multi-tenant ASP.NET Core applications.

Can I use Entra OIDC scope configurations directly with Keycloak identity providers?▼

No, applying Entra-specific OIDC scopes directly to Keycloak identity providers causes authentication failures, requiring distinct scope parameter management to ensure token storage and refresh requests remain compliant with provider-specific implementations.

What is the best way to prevent production deployments from accidentally requesting long-lived offline tokens in Keycloak?▼

The best way to prevent accidental long-lived offline-token requests in Keycloak is to apply configuration guardrails that distinguish between standard session refresh tokens and offline-token requests during the OIDC flow.

How do I configure ASP.NET Core OIDC refresh flows to avoid offline-token grant errors with Keycloak?▼

Configure ASP.NET Core OIDC refresh flows by ensuring the refresh token request omits the scope parameter when an offline_access token is bound to the session, avoiding offline-token grant errors with Keycloak.

Does Keycloak OIDC support the same offline_access scope behavior as Entra?▼

No, Keycloak OIDC implementation requirements differ from Entra, meaning the offline_access scope behavior must be handled distinctly to ensure token storage and refresh requests remain compliant across diverse identity providers.

Related Skills

Explore More Software Engineering Skills→
ivegamsftivegamsft

identity-migration

Migrate legacy authentication systems to ASP.NET Core Identity with Azure Entra ID.

Community
Advanced
jonnymuirjonnymuir
1

generic-oidc-downstream-session-binding

Validate Prism downstream sessions for generic OIDC tenants by comparing issuer and client identity claims.

Community
Advanced
DuendeSoftwareDuendeSoftware
10

aspnetcore-authentication

Configure cookies, OpenID Connect, and JWT Bearer authentication in ASP.NET Core.

Official
Advanced
oryory

ory-social-login

Configure OAuth2/OIDC social login providers in Ory identity configs.

Official
Intermediate