Re: [keycloak-user] Token exchange: on-behalf-of + downgrade

Yes, I tried. It seems, that scope parameter is ignored and this is also said in the documentation (https://www.keycloak.org/docs/latest/securing_apps/index.html#_token-exch...): scope NOT IMPLEMENTED. This parameter represents the target set of OAuth and OpenID Connect scopes the client is requesting. It is not implemented at this time but will be once Keycloak has better support for scopes in general. Other settings for client applications do not work. Below are tokens which I got for calling client and after token exchange in my test application. It has a bit more complex structure than I described before. It is: user —> jsp-web-app —> docs-svc —> facade-svc —> svc-1 —> svc-2 Token exchange happens when facade-svc calls svc-2. Below are two tokens: First is a token which is used to call from jsp-web-app to facade-svc Second is a token which I have after token exchange in facade-svc to call svc-2. For this test I configured facade-svc so that it cannot call ’svc-2’ at all (svc-2 is absent in Scope and Client Scope tabs). But after token exchange ’svc-2’ is successfully called. Note, how wide scope, roles and audience of the exchanged token are. facade-svc is only allowed to call ’svc-1’. Also, in the exchanged token I see audiences and scopes which were not present in the original caller’s token. { "jti": "863d8801-dd28-4314-8b50-4ddefe97c380", "exp": 1551344900, "nbf": 0, "iat": 1551344600, "iss": "http://localhost:8180/auth/realms/DTGOpenIDDemoApp", "aud": [ "facade-svc", "docs-svc" ], "sub": "6d312ba3-aa9e-4646-af57-95a9e965b8a9", "typ": "Bearer", "azp": "jsp-web-app", "auth_time": 1551343339, "session_state": "3606845e-9f85-4dc7-8edb-41ce3ab67268", "acr": "0", "allowed-origins": [ "http://localhost:8080" ], "resource_access": { "facade-svc": { "roles": [ "user" ] }, "docs-svc": { "roles": [ "user" ] } }, "scope": "openid profile email", "email_verified": false, "organization": "Org-1", "preferred_username": "user" } { "jti": "cef6ae27-0e98-491d-9ef2-69850b664766", "exp": 1551341466, "nbf": 0, "iat": 1551341166, "iss": "http://localhost:8180/auth/realms/DTGOpenIDDemoApp", "aud": [ "facade-svc", "docs-svc", "account", "svc-2" ], "sub": "6d312ba3-aa9e-4646-af57-95a9e965b8a9", "typ": "Bearer", "azp": "facade-svc", "auth_time": 1551341150, "session_state": "dcfa21cc-57a2-4302-a459-d772b5f79f13", "acr": "1", "realm_access": { "roles": [ "offline_access", "uma_authorization", "user" ] }, "resource_access": { "facade-svc": { "roles": [ "user" ] }, "docs-svc": { "roles": [ "user" ] }, "account": { "roles": [ "manage-account", "manage-account-links", "view-profile" ] }, "svc-2": { "roles": [ "user" ] } }, "scope": "openid profile email", "email_verified": false, "preferred_username": "user" }