You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm using the token-exchange feature to impersonate user accounts and get an access-token to support legacy use cases when the authentication is performed externally. In this case it seems that the user status is not checked and I can obtain an access-token for a disabled user account. I supposed that this is due to the fact that the token-exchange doesn't do a real login and the status is not checked (I'm not really sure how the account status is enforced actually), but I would like to have a way to prevent login in this case.
Is there a configuration for the token-exchange to check for the status, or maybe a way to have the status in the returned token so it can be checked by the system that requested it?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi,
I'm using the token-exchange feature to impersonate user accounts and get an access-token to support legacy use cases when the authentication is performed externally. In this case it seems that the user status is not checked and I can obtain an access-token for a disabled user account. I supposed that this is due to the fact that the token-exchange doesn't do a real login and the status is not checked (I'm not really sure how the account status is enforced actually), but I would like to have a way to prevent login in this case.
Is there a configuration for the token-exchange to check for the status, or maybe a way to have the status in the returned token so it can be checked by the system that requested it?
All reactions