# Integrating Vault and Keycloak - JWT

**URL:** <https://discuss.hashicorp.com/t/integrating-vault-and-keycloak-jwt/2332>\
**Category:** Vault\
**Created:** [August 12, 2019, 11:23am UTC](https://discuss.hashicorp.com/t/integrating-vault-and-keycloak-jwt/2332 "2019-08-12T11:23:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dr4il](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dr4il/32/1794_2.png) [@Dr4il](https://discuss.hashicorp.com/u/Dr4il)\
**Post date:** [August 12, 2019, 11:23am UTC](https://discuss.hashicorp.com/t/integrating-vault-and-keycloak-jwt/2332/1 "2019-08-12T11:23:31Z")

</div>

Hello!  
I’m trying to integrate JWT logon method. But I stucked in one step. I dont know what i should set in user\_claim and user\_group in my auth/jwt/role/vault-role.  
My settings are looks like this:

> / # vault read auth/jwt/role/vault-role  
> Key Value  
> allowed\_redirect\_uris [[http://127.0.0.1:8200/ui/vault/auth/jwt/oidc/callback](http://127.0.0.1:8200/ui/vault/auth/jwt/oidc/callback)]  
> bound\_audiences [[http://127.0.0.1:8080/auth/realms/test/](http://127.0.0.1:8080/auth/realms/test/)]  
> bound\_claims   
> bound\_subject 73f4e4d6-8d83-4703-984f-xxx@audience  
> claim\_mappings   
> clock\_skew\_leeway 0  
> expiration\_leeway 0  
> groups\_claim e73239eb-14b7-4184-91ff-xxx  
> not\_before\_leeway 0  
> oidc\_scopes   
> policies [default]  
> role\_type oidc  
> token\_bound\_cidrs   
> token\_explicit\_max\_ttl 0s  
> token\_max\_ttl 0s  
> token\_no\_default\_policy false  
> token\_num\_uses 0  
> token\_period 0s  
> token\_policies [default]  
> token\_ttl 1h  
> token\_type default  
> ttl 1h  
> user\_claim \*  
> verbose\_oidc\_logging false

And jwt config file:

> bound\_issuer [http://127.0.0.1:8080/auth/realms/test/protocol/openid-connect/auth](http://127.0.0.1:8080/auth/realms/test/protocol/openid-connect/auth)  
> default\_role vault-role  
> jwks\_ca\_pem n/a  
> jwks\_url n/a  
> jwt\_supported\_algs   
> jwt\_validation\_pubkeys   
> oidc\_client\_id vault  
> oidc\_discovery\_ca\_pem n/a  
> oidc\_discovery\_url [http://keycloak:8080/auth/realms/test](http://keycloak:8080/auth/realms/test)

When I tried to logon, I can see button “Sign in with OIDC Provider”, after authenticate I got a error

> Token verification failed. sub claim does not match bound subject

group\_claim I took from keycloak\>Clients\>Credentials\>Secret  
bound\_subject from Client Scopes\>rolename\>Mappers\>ID

Could you give me any hints?