<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">There is this specs, but not sure if
it's useful exactly for the case like this :
<a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-05">https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-05</a><br>
<br>
+1 from me for JIRA and PR for your little extension for now.<br>
<br>
Marek<br>
<br>
On 08/08/16 14:52, Thomas Darimont wrote:<br>
</div>
<blockquote
cite="mid:CAK-7U1j8vpn1AJ__TsgLjB4tO18p5zd7kxR5ZAyg3KXw9iguUg@mail.gmail.com"
type="cite">
<p dir="ltr">Thanks Marek,</p>
<p dir="ltr">Service2 is more or less a service proxy which
performs additional authz checks. So service1 can only access
the oidc parts of keycloak but service2 has broader access...<br>
Benefit is that the action in Keycloak is performed with the
Identity information of the initiating service1 user which is
then logged accordingly in Keycloak.</p>
<p dir="ltr">Is this token exchange backed by a spec?</p>
<p dir="ltr">May I create a JIRA and a PR for my little extension?</p>
<p dir="ltr">Cheers,<br>
Thomas</p>
<br>
<div class="gmail_quote">
<div dir="ltr">Marek Posolda <<a moz-do-not-send="true"
href="mailto:mposolda@redhat.com">mposolda@redhat.com</a>>
schrieb am Mo., 8. Aug. 2016, 14:42:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>+1 to have support for scenario like this. <br>
<br>
One small disadvantage of your approach is, that service2
will use accessToken, which was issued to service1. It
seems that more proper way might be to have service on
Keycloak side, that will allow service2 to exchange the
service1 token for it's own token. However that will
likely require much more work though...<br>
<br>
Marek</div>
</div>
<div bgcolor="#FFFFFF" text="#000000">
<div><br>
<br>
On 08/08/16 09:58, Thomas Darimont wrote:<br>
</div>
</div>
<div bgcolor="#FFFFFF" text="#000000">
<blockquote type="cite">
<div dir="ltr">
<div>Hello group,<br>
</div>
<div><br>
</div>
<div>I have the following scenario:</div>
<div>1) A SSO authenticated User1 calls Service1
(confidential client).</div>
<div>2) Service1 extracts access token.</div>
<div>3) Service1 performs a remote call to Service2
passing the access token along.</div>
<div>4) Service2 needs to do something in the name of
User1 in Keycloak (e.g. set a user attribute, or
create a new users)</div>
<div>5) Service2 uses org.keycloak.admin.client.Keycloak
to communicate with Keycloak<br>
</div>
<div>to perform the requested operation.</div>
<div><br>
</div>
<div>I want to be able to propagate the access token in
</div>
<div>Service to service calls and use the
'org.keycloak.admin.client.Keycloak' client</div>
<div>with the provided access token to perform an
operation in Keycloak. </div>
<div><br>
</div>
<div>Currently 'org.keycloak.admin.client.Keycloak' only
supports client credentials and / or password,</div>
<div>which it uses to get an refresh token to renew a
potentially timed out access token.</div>
<div><br>
</div>
<div>As a PoC I slightly adjusted the Keycloak client to
allow for externally provided access tokens:</div>
<div><a moz-do-not-send="true"
href="https://gist.github.com/thomasdarimont/d82c4478df997556a9d16afb79787459"
target="_blank">https://gist.github.com/thomasdarimont/d82c4478df997556a9d16afb79787459</a><br>
</div>
<div><br>
</div>
<div>I think the Keycloak Client should also support
"call once" scenarios with a provided access token out
of the box.</div>
<div><br>
</div>
<div>Shall I create a JIRA for this?</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Thomas </div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote>
</div>
<div bgcolor="#FFFFFF" text="#000000">
<blockquote type="cite">
<pre>_______________________________________________
keycloak-dev mailing list
<a moz-do-not-send="true" href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a>
<a moz-do-not-send="true" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</div>
</blockquote>
</div>
</blockquote>
<br>
</body>
</html>