Token Exchange from Confidential to Public Client in v18+ #14367

skhro87 · 2022-09-13T09:03:35Z

skhro87
Sep 13, 2022

Hello Community,

After trying to solve this issue myself for some time, I kindly ask for your help and guidance.

We have the following multi-tenant setup in our Keycloak:

One "Internal" realm for internal support staff.
N number of "Customer" realms for customer's users (each has a public "frontend" client and a confidential "internal_service" client)
Default built-in "Master" Keycloak realm

We want the "Internal" users to be able to "login as user" into any "Customer" realm.
We implemented the following flow:

"Internal" user gets token from KC
"Internal" user requests to impersonate target "Customer" user to Backend
Backend uses secret Master realm credentials to get an access token for the target realm's "internal_service" confidential client
Backend uses the acquired access token of step 3 to perform a token-exchange to the target user and target "frontend" client
Backend returns target user's access token to the initial requester of step 1.

The flow used to work before upgrading to Keycloak 18, however it is now broken.
When performing the token exchange in step 4, the response is:

{
    "error": "access_denied",
    "error_description": "Client is not the holder of the token"
}

From some research, I understand that the problem is that the subject_token in the token-exchange has a different azp ("internal_service") then then client_id that we perform the token-exchange for ("frontend").

Is there a better way to perform the same functionality?
Am I overlooking something? I tried to find ways to overwrite the azp when getting the "internal_service" confidential client token in step 3, but this does not seem possible (which makes sense, from security perspective).

Any help would be greatly appreciated, thank you.

pazaan · 2023-01-04T12:25:38Z

pazaan
Jan 4, 2023

We recently came across a similar thing when upgrading from 16 to 20.
We resolved it by enabling admin-fine-grained-authz, turning on Fine grained permissions for our target client, and creating the token-exchange permission for the target client. Then we created a Client Policy for the source client, and applied that new policy to the token-exchange permission we created for the target client.

2 replies

skhro87 Feb 20, 2023
Author

thank you! I will try that out!

IshwarSingh16 Apr 24, 2023

Hi @skhro87 did u get any solution?

Navigation Menu

Repository navigation

Token Exchange from Confidential to Public Client in v18+ #14367

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Token Exchange from Confidential to Public Client in v18+ #14367

Uh oh!

Uh oh!

skhro87 Sep 13, 2022

Replies: 1 comment · 2 replies

Uh oh!

pazaan Jan 4, 2023

Uh oh!

skhro87 Feb 20, 2023 Author

Uh oh!

IshwarSingh16 Apr 24, 2023

skhro87
Sep 13, 2022

Replies: 1 comment 2 replies

pazaan
Jan 4, 2023

skhro87 Feb 20, 2023
Author