Hi, @Anusha_sunkadh.
Thank you very much for your help!
Now the problem is solved. For anyone else facing this issue, here are the steps I followed:
My keycloak installation uses:
image: mosipid/mosip-artemis-keycloak:1.2.0.1
Keycloak Server version: 16.1.1
I used the following installation script for Keycloak:
helm -n $NS upgrade --install $SERVICE_NAME mosip/keycloak \
--version "7.1.18" \
--set image.repository=mosipid/mosip-artemis-keycloak \
--set image.tag=1.2.0.1 \
--set image.pullPolicy=Always \
--set postgresql.image.repository=bitnamilegacy/postgresql \
--set postgresql.image.tag=14.2.0 \
--set volumePermissions.image.repository=bitnamilegacy/os-shell \
--set metrics.image.repository=bitnamilegacy/postgres-exporter \
--set global.security.allowInsecureImages=true \
-f values.yaml \
--wait
I checked the Keycloak client settings.
All clients have the “roles” client scope, and this scope contains the built-in mapper “audience resolve”.
I tried adding custom mappers to some clients, and in those mappers I added the client audience.
Now I have mosip-reg-client, mosip-ida-client, and mosip-auth-client, and each of them returns an “aud” field in the token: “mosip-reg-client”, “mosip-ida-client”, or “mosip-auth-client”.
(I will try install other keycloak versions later.)
The next problem was:
2025-11-21 16:16:03,706 DEBUG [Thread-49] i.m.r.u.r.RestClientUtil : invoke method ended https://api-internal.mosip.mosip.local.com/registrationprocessor/v1/registrationstatus/auth?version
...
2025-11-21 16:16:03,707 DEBUG [Thread-49] i.m.r.u.r.ServiceDelegateUtil : Post method ended - ida_auth
2025-11-21 16:16:03,708 ERROR [Thread-49] i.m.r.s.o.i.UserOnboardServiceImpl : REGISTRATION - USER_ONBOARD - USER_ONBOARD_IMLP - REGISTRATION - REG - java.lang.NullPointerException
at io.mosip.registration.service.operator.impl.UserOnboardServiceImpl.userOnBoardStatusFlag(UserOnboardServiceImpl.java:469)
In IDEA Debugging I have seen:
<200,{id=mosip.identity.auth.internal, transactionID=null, response=null, responseTime=2025-11-21T13:56:50.829Z, version=1.0, errors=[{errorCode=RPR-RCT-001, errorMessage=Unable to access API}]},{Server=[nginx], Date=[Fri, 21 Nov 2025 13:56:50 GMT], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Connection=[keep-alive], x-content-type-options=[nosniff], x-xss-protection=[1; mode=block], cache-control=[no-cache, no-store, max-age=0, must-revalidate], pragma=[no-cache], expires=[0], x-frame-options=[SAMEORIGIN], x-envoy-upstream-service-time=[41]}>
<{id=mosip.identity.auth.internal, version=1.0, requestTime=2025-11-21T13:51:47.833Z, env=Staging, domainUri=https://api-internal.mosip.mosip.local.com, transactionID=1234567890, consentObtained=true, individualId=operator01, individualIdType=USERID, keyIndex=, requestedAuth={bio=true}, ...
I searched for information about the RPR-RCT-001 error and found this post: Registration client onboarding - #2 by sanchi-singh24
So, in Keycloak, for the user operator01, I added the attribute individualId = 6735423821 — this was an unused UIN taken from the mosip_kernel.kernel.uin table.
Then something went wrong with the config-server pod - request above was returning timeout errors. I reloaded the config-server deployment, and finally I was able to Update Operator Biometric, then add New Registration, approve and upload it!