Wildfly with Keycloak impersonation with token exchange #38223

x-c4mp3r · 2025-03-18T15:54:29Z

x-c4mp3r
Mar 18, 2025

Dear Everyone!

I make this question too in wildfly forum but haven't got any answer yet, so that's why I'm asking here.

I would like to implement impersonation feature with token exchange in my jakarta ee backend application with wildfly.
My setup using the new Wildfly Elytron security subsystem the security domain was setted in standalone.xml, oidc.json setted inside the war application.
When I open the app in the browser it's redirecting me to keycloak login screen to auth when it's succeed the app is redirected to the corresponding URL, everything is working fine.
I would like to implement the impersonation so I wrote the token exchange it's works well got back the 200 OK with the json including access_token, refresh_token, expires_in fields, but I'm stuck here. I don't understand how can I change the current user session to the new one in wildfly and browser. I tried this but not working:

                AccessTokenResponse accessTokenResponse = createTokenExchange(userToImpersonate.getId(), getLoggedInUserTokenString()); //here the https://www.keycloak.org/securing-apps/token-exchange#_making_the_request_2 was implemented, userToImpersonate.getId() is equals to keycloak user ID value
                request.getSession().invalidate(); //invalidate current session
                SecurityDomain securityDomain = SecurityDomain.getCurrent(); //from here to the end creating new session based on the token exchange response
                RefreshableOidcSecurityContext refreshableOidcSecurityContext = (RefreshableOidcSecurityContext) oidcSecurityContext;

                AccessToken token = accessTokenResponse.getToken() == null ? null : new AccessToken(new JwtConsumerBuilder().setSkipSignatureVerification().setSkipAllValidators().build().processToClaims(accessTokenResponse.getToken()));
                IDToken idToken = accessTokenResponse.getIdToken() == null ? null : new IDToken(new JwtConsumerBuilder().setSkipSignatureVerification().setSkipAllValidators().build().processToClaims(accessTokenResponse.getIdToken()));

               //create a principal which is used inside securityDomain.authenticate(...)
                OidcPrincipal<RefreshableOidcSecurityContext> oidcPrincipal = new OidcPrincipal<>(
                        userToImpersonate.getId(),
                        new RefreshableOidcSecurityContext(
                                refreshableOidcSecurityContext.getOidcClientConfiguration(), //we get OidcClientConfiguration from the prev session/request 
                                null, //tokenStore is null, because I don't know how to create or access the already existing one
                                accessTokenResponse.getToken(),
                                token,
                                accessTokenResponse.getIdToken(),
                                idToken,
                                accessTokenResponse.getRefreshToken()
                        )
                );

                // Create a new security identity with the new token
                SecurityIdentity newIdentity = securityDomain.authenticate(new Evidence() {
                    @Override
                    public Principal getDecodedPrincipal() {
                        return oidcPrincipal; //used inside the authenticate method so this must be supplied
                    }
                });

                newIdentity.createRunAsIdentity(oidcPrincipal, false);

When I'm using createRunAsIdentity with authorize=true it's throwing an exception:

ELY01088: Attempting to run as "*-*-*-*-*" authorization operation failed:
org.wildfly.security.authz.AuthorizationFailureException: ELY01088: Attempting to run as "*-*-*-*-*" authorization operation failed

when authorize=false there is no exception thrown but when refreshing the page the same user logged in.
Tried to expire the cookies (AUTH_SESSION_ID, AUTH_SESSION_ID_LEGACY, KEYCLOAK_IDENTITY, KEYCLOAK_IDENTITY_LEGACY, KEYCLOAK_LOCALE, KEYCLOAK_REMEMBER_ME, KEYCLOAK_SESSION, KEYCLOAK_SESSION_LEGACY) too after this api call returns, but not solved the problem.
Also tried to logout first then call the api still not solved the problem.

Thanks for any help!

hamza86 · 2025-03-26T09:18:41Z

hamza86
Mar 26, 2025

Currently, i'm also struggling with this issue. There is a lack of documentation or example on how to switch the session.

0 replies

Navigation Menu

Repository navigation

Wildfly with Keycloak impersonation with token exchange #38223

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Wildfly with Keycloak impersonation with token exchange #38223

Uh oh!

Uh oh!

x-c4mp3r Mar 18, 2025

Replies: 1 comment

Uh oh!

hamza86 Mar 26, 2025

x-c4mp3r
Mar 18, 2025

hamza86
Mar 26, 2025