With Keycloak 25+, the `basic` scope has been introduced which contains claims `sub` and `auth_time`: https://www.keycloak.org/docs/latest/release_notes/index.html#lightweight-access-token-to-be-even-more-lightweight. Before, these claims were added by default. Now, as we do not yet add the `basic` scope with `univention-keycloak`, these claims are missing from the token.
This is a duplicate, and has been fixed in https://forge.univention.org/bugzilla/show_bug.cgi?id=58255 *** This bug has been marked as a duplicate of bug 58255 ***