As a pentester I would like to get more familiar with JSON Web Tokens. So I'm searching for some open source web applications as a testing target.
Sure, I found tons of tutorials and small example applications that shows the basic usage of creating and validating JWTs. But I'm looking for a more real world / productive application with different user roles, etc. A bonus would be the integration of Keycloak. The programming language would preferably be PHP or Java - but any other is also fine.
Does anyone have some suggestions?