How to configure Token Exchange between two different instances of KeyCloak? #42216

tarazena · 2025-08-28T17:46:00Z

tarazena
Aug 28, 2025

Hey All, I have the following setup

---
config:
  theme: redux
  layout: dagre
---
flowchart TD
    A["Client"] --> B["API Server A"]
    B --> C["API Server B"]
    D["Keycloak B"]
    B -->D
    C --> D
    D --> n1
    A["Client"] -->  n1["Keycloak A"]
    B["API Server A"] --> n1["Keycloak A"]
    A@{ shape: proc}
    B@{ shape: proc}
    n1@{ shape: proc}
    C@{ shape: proc}
    D@{shape: proc}

Client will talk to KeyCloak A to get JWT token
API Server A will validate the Token against Keycloak A
API Server A will exchange the token against Keycloak B
Client will get new token and use it in API Server B
API Server B will validate the token.

in API Server A, when I try to exchange the token from Keycloak B, I'm getting this error

WARN  [org.keycloak.events] (executor-thread-1) type="TOKEN_EXCHANGE_ERROR", realmId="281f7ebc-d6a1-420e-aae3-737f860319b6", realmName="lhr_realm", clientId="lhr_api", userId="null", ipAddress="192.168.65.1", error="invalid_token", reason="subject_token validation failure", auth_method="token_exchange", grant_type="urn:ietf:params:oauth:grant-type:token-exchange", requested_token_type="urn:ietf:params:oauth:token-type:access_token", client_auth_method="client-secret"

Here is my node.js axios request

      const tokenExchangeUrl = `${LH_AUTH_URL}/realms/lhr_realm/protocol/openid-connect/token`;
      console.log('TOKEN: ', token);
      const params = new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
        client_id: LHR_CLIENT_ID,
        client_secret: LHR_CLIENT_SECRET,
        subject_token: token,
        subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
        requested_token_type: 'urn:ietf:params:oauth:token-type:access_token',
        audience: 'lhr_api',
      });

      const response = await axios.post(tokenExchangeUrl, params, {
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded',
        },
      });

I've added Keycloak A as an Keycloak OIDC provider in Keycloak B, and added a client in KeyCloak A to exchange the tokens, what am I doing wrong?

here is my JWT Token that the client is getting

{
  "exp": 1756403078,
  "iat": 1756402778,
  "auth_time": 1756402778,
  "jti": "onrtac:f2805b27-cfc3-6c4d-5b72-6956f358fc55",
  "iss": "http://localhost:8080/realms/global_directory_realm",
  "aud": [
    "global_directory_web",
    "account"
  ],
  "sub": "1c92da8f-043f-4f57-8c20-b1298b2716dd",
  "typ": "Bearer",
  "azp": "global_directory_web",
  "sid": "f54e4331-fad5-4368-a8fc-cd8288d1f77f",
  "acr": "1",
  "allowed-origins": [
    "*"
  ],
  "realm_access": {
    "roles": [
      "offline_access",
      "uma_authorization",
      "default-roles-global_directory_realm"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid profile email",
  "email_verified": false,
  "name": "test test",
  "preferred_username": "test",
  "given_name": "test",
  "family_name": "test",
  "email": "test@test.test"
}

Thanks

Navigation Menu

Repository navigation

How to configure Token Exchange between two different instances of KeyCloak? #42216

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

How to configure Token Exchange between two different instances of KeyCloak? #42216

Uh oh!

tarazena Aug 28, 2025

Replies: 0 comments

tarazena
Aug 28, 2025