# MongoDB 8.0.23 - OIDC authentication via Keycloak **URL:** \ **Category:** MongoDB\ **Tags:** community, percona, mongodb, new-release\ **Created:** [June 25, 2026, 7:39pm UTC](https://forums.percona.com/t/mongodb-8-0-23-oidc-authentication-via-keycloak/40963 "2026-06-25T19:39:39Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![pshah](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@pshah](https://forums.percona.com/u/pshah)\ **Post date:** [June 25, 2026, 7:39pm UTC](https://forums.percona.com/t/mongodb-8-0-23-oidc-authentication-via-keycloak/40963/1 "2026-06-25T19:39:40Z")
Hi While to setup and test OIDC authentication for Percona MongoDB 8.0.23 using Keycloak - the authentication does not work. I tried using mongosh ( ubuntu host ) and also via MongoDB Compass On MongoDB Compass side - I am little further and get this error message “$external”,“error”:“BadValue: Invalid JWT :: caused by :: unsupported issuer or audience”, while on the mongosh side - I get this message - Error: Unable to fetch issuer metadata for \<[https://youknow.what.com/realms/Mongodb](https://youknow.what.com/realms/Mongodb)" Any one has faced this situation and any feedback/suggestion ? Thank you in advance ---
**Author:** ![Konstantin\_Trushin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/konstantin_trushin/32/5947_2.png) [@Konstantin\_Trushin](https://forums.percona.com/u/Konstantin_Trushin)\ **Post date:** [June 26, 2026, 12:36pm UTC](https://forums.percona.com/t/mongodb-8-0-23-oidc-authentication-via-keycloak/40963/2 "2026-06-26T12:36:45Z")
Hello @pshah, Thank you for the question. To conduct a deeper analysis, we need more information. Could you please provide detailed steps to reproduce the issue, including the exact commands used and your Keycloak and `mongod` configurations? Thanks in advance ---
**Author:** ![pshah](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@pshah](https://forums.percona.com/u/pshah)\ **Post date:** [June 26, 2026, 6:19pm UTC](https://forums.percona.com/t/mongodb-8-0-23-oidc-authentication-via-keycloak/40963/4 "2026-06-26T18:19:31Z")
Thanks for reaching out to me. Since yesterday - I was trying to find a solution for this problem. I got little success with connecting from MongoDB compass but not from mongosh ( Ubuntu host ) When i used curl to find out what access token I was getting - from Keycloak - I found out that there were 2 audience values were reported - mongodb-client ( which I wanted ) and also account. While trying to research this - I found out from web - on how to remove the account (audience default value). Once I was able to fix that - I got these values for Keycloak ( modifed for viewing here ) { “exp”: 1782496554, “iat”: 1782496254, “jti”: “2e61e825-9032-41e2-9bf7-65e72219e510”, “iss”: “realms/Mongodb", “aud”: “mongodb-client”, “sub”: “myemailaddress", “typ”: “Bearer”, “azp”: “mongodb-client”, “sid”: “d6168019-b043-402b-b729-53b1e197675c”, “acr”: “1”, “scope”: “profile email”, “email\_verified”: true, “name”: “myname”, “preferred\_username”: “myemailaddress", “given\_name”: “my first name”, “MyClaim”: [ “/database\_admin” ], “family\_name”: “my last name”, “email”: “myemailaddress" } My mongodb OIDC values in mongod.conf setParameter: authenticationMechanisms: MONGODB-OIDC, PLAIN, SCRAM-SHA-1, SCRAM-SHA-256 oidcIdentityProviders: ‘[ { issuer: "”realms/Mongodb, clientId: “mongodb-client”, audience: “mongodb-client”, authNamePrefix: “keycloak”, principalName: “preferred\_username”, useAuthorizationClaim: true, supportsHumanFlows: true, authorizationClaim: “MyClaim” } ]’ MongoDB Compass - some of the setting needed - direct access / redirect address / trusted host / host were the instance is running etc. Later - MongoDB Compass is able to connect to MongoDB instance on the Ubuntu host - mongosh fails still - even when MongoDB compass works. error reported - Error: Unable to fetch issuer metadata for “realms/Mongodb": something went wrong (caused by: The operation was aborted.) in mongodb log “error”:“AuthenticationAbandoned: Authentication session abandoned, client has likely disconnected” ---
**Author:** ![Konstantin\_Trushin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/konstantin_trushin/32/5947_2.png) [@Konstantin\_Trushin](https://forums.percona.com/u/Konstantin_Trushin)\ **Post date:** [July 1, 2026, 11:50pm UTC](https://forums.percona.com/t/mongodb-8-0-23-oidc-authentication-via-keycloak/40963/5 "2026-07-01T23:50:58Z")
Hello @pshah, We are tracking this issue in Jira ticket [PSMDB-2162](https://perconadev.atlassian.net/browse/PSMDB-2162). Regards, Konstantin. ---
**Author:** ![Konstantin\_Trushin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/konstantin_trushin/32/5947_2.png) [@Konstantin\_Trushin](https://forums.percona.com/u/Konstantin_Trushin)\ **Post date:** [September 8, 2026, 1:44pm UTC](https://forums.percona.com/t/mongodb-8-0-23-oidc-authentication-via-keycloak/40963/6 "2026-09-08T13:44:07Z")
Hello @pshah, Sorry for the significant delay in response. What concerns me in your `mongod.conf` is the following line: ```auto issuer: "realms/Mongodb", ``` I believe this field should keep the full URL of the identity provider rather than a path only. When using the OIDC authentication mechanism, `mongosh` asks the the `mongod` the endpoint of the identity provider (in our case, KeyCloak server) where it should redirect a user for authentication. On the `mongod` side, this endpoint is configured in the `issuer` field. If only a path is specified there, then `mongosh` won’t know the address of the identity provider to authenticate a user to and draw a token (for subsequent authentication to `mongod`) from. That’s why you are getting the `"Unable to fetch issuer metadata"` error. For instance, below is an example of configuring `issuer` in Percona Server for MongoDB [documentation](https://docs.percona.com/percona-server-for-mongodb/8.3/oidc-keycloak.html#__tabbed_1_1) ```auto "issuer": "https://my.keycloak.org:8443/realms/mongodb", ``` Could you please specify the URL of your identity provider in the `issuer` field and check whether that helps? With best regards, Konstantin.