Repository navigation
❓ How to properly exchange a Google ID token with Keycloak using OAuth 2.0 Token Exchange? #39521
Unanswered
akshay-softobotics
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi everyone,
I'm trying to exchange a Google ID token for a Keycloak access token using the OAuth 2.0 Token Exchange flow. I'm using the urn:ietf:params:oauth:grant-type:token-exchange grant type, and I believe I’ve followed the spec correctly, but the exchange is failing. Here's a summary of my implementation:
params.append("grant_type", "urn:ietf:params:oauth:grant-type:token-exchange"); params.append("client_id", clientId); params.append("client_secret", clientSecret); params.append("subject_token_type", "urn:ietf:params:oauth:token-type:access_token"); params.append("subject_token", idToken); // This is actually a Google access token params.append("subject_issuer", "google"); params.append("scope", "openid"); params.append("requested_token_type", "urn:ietf:params:oauth:token-type:access_token");A few things I’m unsure about:
Should subject_token_type be access_token or id_token when using a Google ID token? Google provides an ID token during login, and I’m passing that into the subject_token field. Should I instead be using:
urn:ietf:params:oauth:token-type:id_tokenWhat should the subject_issuer be set to? I currently have it as "google", but should this match the alias of the identity provider configured in Keycloak?
Are there any specific settings in Keycloak that need to be enabled for token exchange to work with an external IdP like Google? The identity provider is configured in Keycloak and works fine for standard browser login flows.
Do I need to use a special client or configure token mappers to make this work?
Is there a way to debug or see more details in Keycloak logs when token exchange fails?
Any help or guidance would be much appreciated. Thanks!
All reactions