Impersonation/token exchange only for certain users #14821

G-2-Z · 2022-10-10T15:00:18Z

G-2-Z
Oct 10, 2022

I stumbled upon the following stack overflow article while having a similiar use case as described: https://stackoverflow.com/questions/71746975/keycloak-impersonation-only-for-certain-users. The problem at hand is having multiple groups and restricting the permission to impersonate or token exchange only for users of the same group.

According to one answer given, creating groups and assigning viewing permissions should accomplish that, because you can only impernonate users you can view. There also is a (dated) mailing list thread attached where this is explicitly said: https://lists.jboss.org/pipermail/keycloak-user/2018-July/014619.html.

I tried exactly that, but i found that a user with impersonation permission can impersonate users he or she cannot view. Is this the intended behaviour? I would say it definitly is not the excpected behaviour.

Does anyone else tried the same thing and was successfull? Maybe i did something wrong?

Navigation Menu

Repository navigation

Impersonation/token exchange only for certain users #14821

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Impersonation/token exchange only for certain users #14821

Uh oh!

G-2-Z Oct 10, 2022

Replies: 0 comments

G-2-Z
Oct 10, 2022