Repository navigation
Token exchange and service account role #40335
Unanswered
antoinechamot
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Use Case:
An administrator makes a request to an endpoint of Service A. This service performs actions on users using a secured client (client ID, client secret) with specific service account roles (user management). As a result, some events are generated, but the user associated with these events is the service itself, not the administrator.
To avoid this behavior and have the administrator user appear in the generated events, I attempted to perform a token exchange. The administrator token generated by a public client is exchanged by the service A using the secured client to obtain a new token.
However, the new access token does not inherit the account roles (user management), preventing any actions on users with it.
Question:
How can I perform a token exchange with a role upgrade that includes the service account roles of the client performing the exchange ?
All reactions