Re: [keycloak-user] [External] Re: Offline tokens

Hi Marek Thanks for that info the token exchange feature looks interesting and might be a way for me to solve my requirement. I didn’t see anything in the docs saying that I could use it to get an offline token but it's worth a shot. Has anyone out there used this to get offline tokens? If this is possible then it would be the preferable option for me. The service accounts option is a bit fiddly as I would need a separate service account for each user (at least that’s how I think that would work). Unless it were possible to fully automate the creation of these service accounts on demand, associate them with a specific user and then grab their offline token. I'll look further into option 1 and get back to you with how I get on. Thanks again John Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4 This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (“Accenture”), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978 On 29/01/2018, 16:13, "Marek Posolda" <mposolda(a)redhat.com&gt; wrote: Not sure we have direct support for this. What we have is: - Token Exchange service -- The new thing added in Keycloak 3.4 (I think). It's available in Keycloak 3.4.3 for sure. It can be possibly used to exchange the token of authenticated admin for the token of user (Impersonation of tokens). Not 100% sure if it's possible. It's new thing and I am still not too familiar with it. You can take a look at docs and see... - Service accounts -- Authenticate on behalf of some client and issue token assigned to client, not to concrete user. Not sure if it suits your needs, just pointing this if you're not aware of that possibility. - If none of previous things can be used, you can create your own custom Authenticator and setup it as Direct Access Grant Flow. The authenticator will somehow allow you to authenticate as any user if you prove your admin identity. Also you can create your own REST endpoint for exchange admin token for the offline token of user (That's also workaround). These possibilities will 100% work, but it's workaround and it's also complicated to do (You would need to code the new authenticator implementation). So would use it just as last fallback. Marek On 29/01/18 12:31, O'Callaghan, John wrote: