In the JWT issuers section of the New realm drawer:
- Each JWT issuer represents an authentication provider capable of issuing JSON Web Tokens. It is possible to have multiple JWT issuers.
- Each issuer links to a JSON Web Key Sets (JWKS) URL.
When going through more than one JWT issuer, it is essential to make sure that the sub claims in the JWT do not overlap between issuers as the sub is the fallback id for users. If the sub is left empty, it is possible to use the id field of the profile mapper to differentiate users.
One JSON Web Key Set (JWKS) can have multiple issuers. Fluid Topics matches issuers from top to bottom and stops at the first match.
It is possible to use a single wildcard (*) or a double wildcard (**) in the Issuer field to cover a range of issuer domains.
For example:
- Base URL +
*+ rest of base URL - Base URL +
**