keycloak - how to setup audience - a matter of associating roles to the client

 Let's say you wanted your client to issue a token that contains "audience" hardcoded a specific value. You can do that in keycloak by setting up Audience mapper under roles. 

To do that create your client, lets call it testspn. In your designated realm, goto "Roles". Then create a new role. Click on "Add mapper".

Then select "Audience". Please ensure that your existing client are not associated with any pre-existing role that has a audience mapper. Please remove it otherwise you would have conflicting audience.

Then fill in the require details as shown here. As you may have noticed, i am trying to setup a federated client to access Azure resources.

And finally associate the role to your client.