Understanding Keycloak's default client scopes

[Patrik-Stas]

When a client is created in keycloak, it has by default assigned various client scope, which in effect add various claims into the issued access tokens for the given client.

Example of such tokens, using default client scopes

{
  exp: 1741070604,
  iat: 1741070304,
  auth_time: 1741070304,
  jti: '501fbaba-bea1-4ca1-93d7-34b9c7db3152',
  iss: 'http://keycloak.127.0.0.1.nip.io/auth/realms/foo',
  aud: [ 'foo', 'account' ],
  sub: 'd50a59bb-59dc-4024-8b1c-943a501e0f5a',
  typ: 'Bearer',
  azp: 'foo',
  sid: 'aa60193b-646f-4f5b-97c7-a8687f19a3e7',
  acr: '1',
  'allowed-origins': [ 'http://localhost:3301' ],
  realm_access: {
    roles: [
      'offline_access',
      'default-roles-foo',
      'uma_authorization'
    ]
  },
  resource_access: {
    account: {
      roles: [ 'manage-account', 'manage-account-links', 'view-profile' ]
    }
  },
  scope: 'email profile',
  email_verified: false,
  name: 'John Smith',
  preferred_username: 'john',
  given_name: 'John',
  family_name: 'Smith',
  email: 'john@example.org'
}

In my eyes right now, I distinguish here 3 types of claims. The required ones per JWT spec, the custom ones which are obvious and related to user profile (name, email, ... ) and then lastly all the others, which are primarily subject of my question. In particular fields like realm_access, resource_access, allowed-origins.
So here's list of my question about the 3rd category of claims:

1. I believe all of these are internal to keycloak, is that right?
2. Why are these added to client by default? In fact, I would like to understand what is the use-case whatsoever. The token having all these keycloak access related claims, what does it allow me to do as opposed to token which does not have these claims? I figured one thing it allows me to do is fetch information about the account:

curl -X GET "http://127.0.0.1:8080/realms/foo/account" \
  -H "Authorization: Bearer <ACCESS_TOKEN>

3. Is there a documentation for what these claims represent and why are they assigned?
4. Is it common to configure my client to omit these claims from issued access tokens? Especially since I only plan to use the issued access tokens to authenticate against my own resources server, not planning to call keycloak APIs.

In case my very own questions indicate some kind of misconception, please help me to get on the right track how to think about this.

Thank you.

[darius-m]

You can look the definitions for most (all?) claims using the admin console. You can go to the scopes tab on a client's details page and you will see all client scopes that are included, either by default or are set to optional (the client may request them, but are not sent out with every request). To inspect what values are included with the tokens, you can go to the mappers tab of each client scope that is enabled for the client. You can also use the "Evaluate" sub-tab in the client scopes tab to evaluate what values are included in each OIDC token (I don't think this works correctly with SAML, as it will still display OIDC tokens, instead of XML assertions).

Implicitly, new clients will have set all client scopes that are defined as default in the client scopes page. Additionally, there is a "dedicated" client scope you can see in the scopes tab of the client, that may add additional mappers for the client specifically; this is also where you can (and probably should) disable the full scope allowed setting for the client (see https://www.keycloak.org/docs/latest/server_admin/index.html#_role_scope_mappings for details).

[darius-m]

Regarding the additional values you are seeing, it may depend on which client you go the tokens for. Considering it includes the "account" audience, is it from the account console client? If so, that may explain why they are included, since the account console is automatically created by Keycloak, and Keycloak specific values make sense. I do not remember seeing them configured for other clients.