8000 Correct Standard Token Exchange with Dynamic Scopes feature enabled by cgeorgilakis · Pull Request #45820 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Correct Standard Token Exchange with Dynamic Scopes feature enabled - #45820

Closed
cgeorgilakis wants to merge 1 commit into
keycloak:mainfrom
eosc-kc:45716_token_exchange_dynamic
Closed

Correct Standard Token Exchange with Dynamic Scopes feature enabled#45820
cgeorgilakis wants to merge 1 commit into
keycloak:mainfrom
eosc-kc:45716_token_exchange_dynamic

Conversation

@cgeorgilakis
@cgeorgilakis cgeorgilakis commented Jan 28, 2026
8000 Copy link
Copy Markdown
Contributor

Closes #45716

This draft PR solves a basic problem for working the Token Exchange with dynamic scopes.
However, two tests are keeping failing. I don't know why. Any help?

cgeorgilakis-grnet
Correct Standard Token Exchange with Dynamic Scopes feature enabled
6711b0f 
Closes keycloak#45716

Signed-off-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>
@cgeorgilakis cgeorgilakis mentioned this pull request Jan 28, 2026
Closed
1 of 2 tasks
@anagri
anagri commented Feb 5, 2026 •
edited
Loading
Copy link
Copy Markdown

reviewers - this is a very critical fix, kindly help with failing test. from skimming through the test, looks like test expectations are incorrect.

@graziang - can you kindly help

@anagri
anagri commented Feb 5, 2026
Copy link
Copy Markdown

actually there is a serious security issue here. we have scope privilege escalation issue.

B 8000 ased on my own extension test, the exchanged token have scopes that are in source token but these scopes are not added as optional scopes on target client, still the exchanged tokens have these scopes added.

@cgeorgilakis
cgeorgilakis commented Feb 5, 2026
Copy link
Copy Markdown
Contributor Author

actually there is a serious security issue here. we have scope privilege escalation issue.

Based on my own extension test, the exchanged token have scopes that are in source token but these scopes are not added as optional scopes on target client, still the exchanged tokens have these scopes added.

Any idea how this could be fixed? With adding appropriate tests.
My fix is related with fixing different default scopes between clients.

@anagri
anagri commented Feb 5, 2026
Copy link
Copy Markdown

Any idea how this could be fixed? With adding appropriate tests. My fix is related with fixing different default scopes between clients.

Also new to keycloak, have not contributed to it yet, so not sure about that.

I have token-exchange in my app/extension, and upgrading to 26.5.0 and toggling on dynamic scope had a test failing, returning 200 which should have returned 400. Given I have scope based access, it was a serious security issue for my app and dug deeper to find this privilege escalation.

@graziang kindly help getting this PR merged. Based on my analysis, this is a serious security/privilege escalation for apps using scope level access control.

@graziang
graziang commented Feb 5, 2026
Copy link
Copy Markdown
Contributor

DYNAMIC_SCOPES is an experimental feature and is not supported for Standard Token Exchange. From the PR, I see that with this fix the Standard Token Exchange tests are failing. The feature should not be enabled for all tests, but only for the dedicated dynamic scopes tests.

@anagri
anagri commented Feb 7, 2026
Copy link
Copy Markdown

DYNAMIC_SCOPES is an experimental feature and is not supported for Standard Token Exchange. From the PR, I see that with this fix the Standard Token Exchange tests are failing. The feature should not be enabled for all tests, but only for the dedicated dynamic scopes tests.

@graziang can you help us where we can get this issue in notice and have it planned properly as part of dynamic scopes implementation?

many thanks.

@cgeorgilakis
cgeorgilakis commented Feb 9, 2026
Copy link
Copy Markdown
Contributor Author

DYNAMIC_SCOPES is an experimental feature and is not supported for Standard Token Exchange. From the PR, I see that with this fix the Standard Token Exchange tests are failing. The feature should not be enabled for all tests, but only for the dedicated dynamic scopes tests.

We could fix DYNAMIC_SCOPES, even being experimental feature, bugs. My draft PR is correcting the default scopes of Standard Token Exchange with DYNAMIC_SCOPES enabled. Do you want to remove the failing tests and make PR ready for review?

@cgeorgilakis cgeorgilakis mentioned this pull request Feb 25, 2026
Closed
@mabartos mabartos mentioned this pull request May 13, 2026
Merged
@mabartos
mabartos commented May 13, 2026
Copy link
Copy Markdown
Member

@cgeorgilakis Thanks! Superseded by: #48981

@mabartos mabartos closed this May 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot will automatically review once the pull request is marked ready for review

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Problem with Standard Token Exchange with Dynamic Scopes feature enabled (Wrong default scopes)

4 participants

@cgeorgilakis @anagri @graziang @mabartos
0