Created Started Finished
By: Tom Sydney Kerckhove <syd@cs-syd.eu>
Check against Keycloak as well as dex One issuer only ever says that the library agrees with that issuer. dex and Keycloak are different implementations that disagree about which grants they still offer, so the driver learned the one each of them has: dex only signs in at its own login page, Keycloak still takes the credentials straight. What the library sees is the same either way. Keycloak also made the driver say what an issuer actually answered when a token request goes wrong. Until it did, three different realm misconfigurations all looked like 'holds no id token'.