Repository navigation
Issue with Identity Provider Token Exchange: "Client not allowed to exchange" #23993
Replies: 3 comments 4 replies
|
Hello there. |
|
Hey, you must enable the token exchange preview feature as written in docs: You need to bash inside your docker container -if using docker- and type the command: kc.sh build --features="preview". If you're using a custom dockerfile image, you need to add this in your dockerfile: |
|
No, when the feature is not enabled, the error is "feature not enabled". The error can only be "Client not allowed to exchange" when this feature is enabled. To double-check if it's enabled, you can go to the admin console and confirm it's listed: |
|
Anyone here solved? |
I successfully enabled the token exchange feature and made it work in my case. I'd like to share the information below, hoping it can help resolve your problem as well. 1. First, make sure you have enabled the feature as pointed out here: #23993 (reply in thread)2. Second, make sure you have enabled "Fine-grained permissions" for the client that'll initiate the token exchange flow. If not enabled, it looks like:3. Then, add a policy to allow the token exchange flow. You need to go to the "realm-management" client to do that, not the client that'll initiate the flow.4. Back to the previous "permission details" tab and apply the policy to the permission:5. Now you are good to test the token exchange flow: |
|
Hi! Thank you so much for your help. I have followed your configuration instructions, but the issue still persists. I am using Keycloak version 23.0.7. Are there any additional configurations or steps I need to complete? Thank you very much! |
|
如果需要更多帮助，欢迎通过 https://www.zhihu.com/consult/people/1073548674713423872 咨询。 |
- 8F6A
Uh oh!
There was an error while loading. Please reload this page.
I'm working on a feature where I need to exchange social tokens (e.g., from Facebook or Google) for Keycloak access tokens. I've configured the external social providers in Keycloak, and the process generally works as expected. However, when attempting to exchange a token from a user that's already linked with the respective identity provider, I encounter a 403 status code with the error message "Client not allowed to exchange".
Here's the relevant request body (as per the provided screenshot):
I've ensured that my configuration aligns with Keycloak's documentation, and I'm at a bit of a loss regarding this error.
Has anyone faced a similar issue? Any insights or solutions would be greatly appreciated.
All reactions