From 72bcea80121e1a11ee6f175313e86f92fee1d5e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20De=20Araujo?= <jdearaujo@auto-planning.fr>
Date: Sun, 25 Jan 2026 16:53:21 +0100
Subject: [PATCH] Fix: Use Keycloak preferred username instead of token

---
 Security/Authenticator/KeycloakAuthenticator.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Security/Authenticator/KeycloakAuthenticator.php b/Security/Authenticator/KeycloakAuthenticator.php
index 4086f22..47cbceb 100644
--- a/Security/Authenticator/KeycloakAuthenticator.php
+++ b/Security/Authenticator/KeycloakAuthenticator.php
@@ -37,6 +37,8 @@ public function authenticate(Request $request): Passport
     {
         $client = $this->getKeycloakClient();
         $accessToken = $this->fetchAccessToken($client);
+        $keycloakUser = $client->fetchUserFromToken($accessToken);
+        $username = $keycloakUser->getPreferredUsername();
         if (null === $accessToken) {
             // The token header was empty, authentication fails with HTTP Status
             // Code 401 "Unauthorized"
@@ -44,7 +46,7 @@ public function authenticate(Request $request): Passport
         }
 
         return new SelfValidatingPassport(
-            new UserBadge($accessToken->getToken(), function() use ($accessToken) {
+            new UserBadge($username, function() use ($accessToken) {
                 return $this->userProvider->loadUserByIdentifier($accessToken);
             })
         );