[Bug]: Nonce Mismatch During Refresh Token Flow with Keycloak (OIDC)

OAuth2-Proxy Version

v7.7.1

Provider

keycloak-oidc

Expected Behaviour

When using the refresh token flow, OAuth2-Proxy should be able to refresh the access token without encountering a nonce mismatch.

https://www.keycloak.org/docs/latest/upgrading/#nonce-claim-is-only-added-to-the-id-token

Current Behaviour

Keycloak does not include a nonce in the ID token when refreshing tokens. Because of this, OAuth2-Proxy throws an error for nonce mismatch when insecureSkipNonce is set to false

Steps To Reproduce

1. Set up OAuth2-Proxy with Keycloak as the identity provider.
2. Configure the proxy with insecureSkipNonce: false.
3. Attempt to refresh the token using the refresh token flow.
4. Observe the nonce mismatch error.

Possible Solutions

No response

Configuration details or additional information

For now, I've added a mapper in Keycloak called Nonce backwards compatible. This temporarily adds a nonce to the ID token after refreshing, which allows OAuth2-Proxy to refresh tokens successfully.