`Missing Access Token Hash` with authentik 2024.2.2

[chief-nerd]

https://goauthentik.io/ @ 2024.2.2

Missing Access Token Hash - 
if you can't configure your IDP to provide an access token hash (delivered using the id token), 
reach out to me to implement some kind of workaround

If I set VERIFY_ACCESS_TOKEN_HASH=false in the config it works, of course.

[madduck]

Can confirm this also works for me. However, it's obviously not the best solution to simply skip verification. Would be interested in a proper fix, as I cannot come up with one apparently :(

[hamid-elaosta]

Has anyone found a solution to this which doesn't involve turning off verification?

I've just set this stack up for the first time. It's not especially clear when Authentik does or doesn't include at_hash but I see a change to Authentik's code back in 2022 that omits it if it's not set as opposed to sending a null value.

As far as I can tell, some nebulous set of conditions must be met in order for it to be included, one of which is the signing key's type.

I'm running Authentik 2024.12.2