Repository navigation
Standard Token Exchange - Requested Audience not available #40870
Replies: 2 comments 8 replies
|
I've managed to workaround this issue by adding the |
|
Hi. Can you please clarify as how you worked around the issue with roles? |
|
I've added a default client scope My entire setup consists of:
The flow:
I use it to reduce the scope of the initial token, before handling consecutive requests. |
|
I’m experiencing the same issue. I want to exchange a token issued for App A into a valid token for App B. Both App A and App B are confidential clients, and App A has token exchange enabled. When App A sends a token exchange request with However, if I make the token exchange request without specifying an audience, the request succeeds — but the resulting token always has: What I don’t understand is:
In addition, I prefer not to assign a special role to every user who needs to be impersonated, so the solution mentioned above is not relevant for my use case. |
|
The So, in general, in token exchange V2 if you plan to perform a token exchange using
Because V2 is different to V1. The
Because the token generated in
Because when processing the request for |
|
Could you elaborate on the linked docs, which are saying:
If adding audiences is not possible, the incoming token would have to have quite an escalated set of privileges, just to be stripped down again later. This means, we need to add audiences somewhere in the middle (to hide from the public client) and strip them later. What would be the flow to add an audience to an incoming token? sequenceDiagram
actor B as Browser
participant PC as Public Client<br/>(Web Page)
participant AG as API Gateway<br/>(api-gw-client-id)
participant BC as Backend API<br/>(backend-client-id)
participant KC as Keycloak
rect rgb(230, 240, 255)
Note over B,KC: Phase 1: Initial Authentication
B->>+KC: Initiate OAuth2 Authorization Code Flow
PC-->>PC: Handle redirects & callbacks
Note over KC: Token (1) audience (static mapper):<br/>web page audience<br/>api-gw-client-id
KC-->>-B: Return Access Token (1)
end
B->>+PC: User interaction
PC->>+AG: GET /api/xyz<br/>Authorization: Bearer Token (1)
rect rgb(255, 250, 230)
Note over AG,KC: Phase 2: Token Exchange
Note over AG: API Gateway has static audience<br/>mapper in KC for backend-client-id
AG->>+KC: Token Exchange Request<br/>audience=backend-client-id
KC-->>-AG: Return Exchanged Token (2)
end
AG->>+BC: Forward request with Token (2)<br/>Authorization: Bearer Token (2)
Note over BC: Token (2) audience:<br/>backend-client-id only<br/>(restricted scope)
BC-->>-AG: API Response (Data)
AG-->>-PC: API Response (Data)
PC-->>-B: Render UI with data
The reason for asking is that the decidsion which audiences to add or not is driven by other mechanisms in the api gateway, not static config in KC. We would like to look at the claims in the public client token and decide on that. |
|
@k1th The audiences in keycloak are managed via mappers, so usually you configure client scopes to add audiences. The paragraph you are pasting is just mentioning that token exchange can request new scopes (and possibly new audiences granted by those scopes). It's just a warning to say that, by default new scopes and audiences is allowed in TE. You can limit that using the downscoping client policy. In general the way to add a new audience in keycloak is mapping the audience mapper (with the wanted audience or audiences) to a client scope. And then request that extra scope (or scopes) in the Token Exchange request. |
|
Thank you, @rmartinc
It is even possible to only use the scope to add the audience, but "hide" the scope from the access token. |
|
You can hide the client scope if you set the |
-
Mention
Uh oh!
There was an error while loading. Please reload this page.
I am trying to setup standard token exchange between multiple clients, although i'm running into the following error:
{ "error": "invalid_request", "error_description": "Requested audience not available: <target_client_id>" }Version
v26.2
Both the initial client and the target client have authentication enabled:
The token from my initial client, only has initial client in the audience, although I want to exchange this for a token minted by the target client.
This is what im sending in my request body:
Is there anything I need to configure within keycloak to allow these 2 clients to exchange tokens with one another? I thought FGAP is not needed with standard token exchange.
Thanks
All reactions