How to understand if a token has been released via token-exchange grant type

Getting advice
,
1

I was able to implement some sort of impersonation flow using the token_exchange preview feature.

I’m inspecting the token of the impersonating user and the token of the impersonated user but I see that there are no claims that allow me to understand that the latter is the impersonated user.

Is there a way to customize the token of the impersonated user so that I understand that we are in a “impersonation context”?

2

In the access token, you should have “auth_method” set to “impersonate”
image

3

@stropia I could not find “auth_metod” in the token. Is there any mapper that helps to do it?

I found a useful default mapper in the latest version of keycloak, it allows to insert the impersonator user id into the token.