How to allow auth_time to be 0

[electerious]

I'm getting the following error when doing a genericGrantRequest using password:

ID Token "auth_time" (authentication time) must be a positive number

The auth_time is actually 0. This is what Keycloak sends when using "Direct access grants". I guess that the auth_time is 0, because the user itself never authenticated / was never redirect to Keycloak and was authenticated using a system with username and password.

I couldn't find a way to disable this check in the openid-client nor to modify this behaviour in Keycloak.

Shouldn't this check be optional? It wasn't a problem in v5.

[panva]

I am not able to neither articulate a passable justification for the value check, nor accept the reasoning for the value used by keycloak.

[electerious]

Turns out that the behaviour has changed and is fixed in the newest Version auf Keycloak. auth_time now has the correct value even when using the direct access grant :)