Direct Naked Impersonation flow

[sginer]

Hello,

I want to configure Keycloak to do person impersonation from a client-credential. I describe behind the flow I want to do.

1 - I get an access-token from client credentials grant on “StartClient” Client Id
2 - I want to request keycloak with the previous access-token to get a specific user access-token from “TargetClient” Client Id

I have done a lot of test with a lot of configuration (token exchange configuration, impersonation configuration …) but no one work.

I will be heppy if someone can give me the full flow on how to configure Keycloak to do this.

If it can be done from another keycloak configuration I’m also interested.

Regards

Stéphane GINER

[joerijansen]

We have this feature running in production.
We used this blog for inspiration: Impersonation in Keycloak – Tomasz Okraska – Everyday not obvious adveantures with coding

[sginer]

Thank for your answer

Finally I found my pb and I have set the correction in this post

Token exchange from client_credential grant

Hi, I want to get a user token from a client credential token but I always got “Client not allowed to exchange” I have created two client : startClient who is the client used to do the token_exchange demo who is the target client I want to echange On demo client I add permissions (policy test allow startClient to use token_exchange) to do token exchange [case] I do my first request to get a startClient access_token whith this parameters grant_type=client_credentials client_id=startClie…

Regards

Stéphane GINER