Hi, two open questions:

1. What about jsonpatch option instead of group alias? Sounds saner to me
2. Wat about multi key/jwt apps, shouldnt it be a map with the keyid as key (with a default)?
   Otherwise looks good

Hi, two open questions:

1. What about jsonpatch option instead of group alias? Sounds saner to me
2. Wat about multi key/jwt apps, shouldnt it be a map with the keyid as key (with a default)?
   Otherwise looks good

1. I don't fully understand what you mean. Maybe a simple gist?
2. I don't know. I haven't seen it in other impl's (smallrye-liberty). And, is there such a use case, that the same app, receives different jwt's, signed with the same private key?

What I do like, is the hierarchy to locatie the groups claim. The example Token1.json in the tck includes an example with customObject.

1. Define a jsonpatch (JsonPatch class) and apply it on the token to get the one used after raw extraction by the runtime. Enables this mapping and more.
2. Our impl does and spec too due to kid support so we must keep it or not add this facility (since it is already doable through other ways)

@dabloem not really tested but to share the idea: 2f4ab72. We can add any needed strategy in the patcher bean (like flattening groups from string or so. Note that being protected the patch impl can trivially be enhanced in any app. Hope it helps.

Aha, thanks.
To be honest, I didn't know about javax.json.JsonPatch class. I thought more of 'allowing' a JsonPatch, therefor I came up with the JsonPatchProcessor.class.
So, we had both the preference for JsonPatch ;-)
I will take a look, and see if I can make a test...