Minimal jwt token payload with keycloak

Question

At my company, we are trying to use Keycloak to generate a jwt token with an minimal payload with only the role of the user, the email et the expiration of the token. We need to use this minimal payload because we have a performance limitation I do not wish to explain further.

Is it possible? and how?

We are using Keycloak v7.0.0 and tried different things with the mappers to expose only what we need without success.

Edit: By removing everything in default scope, I still get a lot I do not need

{
  "jti": "ac6f9ed1-e33b-4204-affc-c5992c600ead",
  "exp": 1571741519,
  "nbf": 0,
  "iat": 1571741219,
  "iss": "http://keycloak:8080/auth/realms/test",
  "sub": "c530d809-fabf-44a7-b186-1d095321edf7",
  "typ": "Bearer",
  "azp": "web_app",
  "auth_time": 0,
  "session_state": "83ce24ff-9e2f-4775-ae2c-066935b7ffa9",
  "acr": "1",
  "scope": "openid"
}

I would like a payload that looks like this

{
 "exp": 1571741519,
 "email": "john@doe.com"
 "groups": ["ROLE_USER"]
}

I am looking into adding a authenticator SPI

Answer 1

By adding a script mapper, we can remove a lot of info from the payload.

token.setIssuer(null)

removes iss key

token.notBefore(null)

set nbf key to 0

You can look at the token JavaDoc for more information on what is possible to change.