Token-Exchange no longer supporting scope parameter in Keycloak versions 24+

[spbatgit]

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

token-exchange

Describe the bug

When using grant_type: urn:ietf:params:oauth:grant-type:token-exchange, the scope parameter is no longer working after Keycloak version 23.0.7. I have observed this issue in all Keycloak versions above 23.0.7. This issue is observed using both Internal->Internal and External->Internal use cases.

Attached is a screen shot of a request utilizing requested scope value.

Version

Keycloak versions 24+ and 25+

Regression

• The issue is a regression

Expected behavior

when providing parameter scope=bt2.write in token exchange request, token returned should include bt2.write in scope claim

Actual behavior

scope parameter is being ignored and requested scopes and are not included in the token returned from the token-exchange.

How to Reproduce?

use any version of Keycloak above 23.0.7 and utilize External->Internal token-exchange with scope parameter in request.

Anything else?

I understand that token-exchange is a preview feature; however, I see that Keycloak is committing to fully supporting the token-exchange RFC including scope parameter: https://docs.google.com/document/d/1plbyw5C1W8q6sYolETfoGqHKIrFWjzYio22o9i6yDOk/edit?pli=1#heading=h.vypot9d955te

[rmartinc]

Hi @spbatgit!

Probably this is related to this issue #21578 (it was included for 24.0.0 so it makes sense). But this is only affecting to client to client exchanges (internal exchanges). I have done a test with external to internal and I can request a scope that is optional in the target client. Are you sure that the error is in an external to internal request? Is it not an internal (client to client) exchange?

Doing this curl to perform the external to internal token exchange:

curl -s -X POST \
  --location http:https://localhost:8080/realms/master/protocol/openid-connect/token \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "client_id=test-oidc" \
  --data-urlencode "client_secret=XXX" \
  --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  --data-urlencode "requested_token_type=urn:ietf:params:oauth:token-type:access_token" \
  --data-urlencode "subject_issuer=http:https://localhost:8080/realms/oidc" \
  --data-urlencode "scope=openid email phone" \
  --data-urlencode "subject_token=$token1" | jq -r ".scope"
openid profile phone email

So phone is there which is optional. If I'm tight this should affect to client to client but external to internal.

[mposolda]

Looks like a duplicate of #29614

[rmartinc]

Yes, if it's client to client is the same. I have tested external to internal and there the scope is OK. So @spbatgit if you confirm that the issue is cluient to client we can close this one as duplicate.

[spbatgit]

My request is across two Keycloak servers and two separate realms, thus, I believe the scenario utilized is the External to Internal. My test case is using two trust domains, Acme1 and Acme2. Acme1 has a Keycloak server and realm BT1Dev. Acme2 has a Keycloak server and realm BT2Dev. My scenario is obtaining a token for Acme1 using grant_type=password. The Acme1 token is then used as the subject_token in a request to Acme2 Keycloak for an Acme2 token. Inorder for the Acme2 token to be used within the Acme2 trust domain, we need to request the claims for the Acme2 domain via the scope parameter. As I mentioned, the scope parameter is working as expected with version 23.0.7; however, when I use a new version of Keycloak, the scope parameter stops working. If you would like, I am willing to do a Zoom call to demonstrate or allow further investigation.

…

On Tue, Jun 25, 2024 at 9:05 AM Ricardo Martin ***@***.***> wrote: Yes, if it's client to client is the same. I have tested external to internal and there the scope is OK. So @spbatgit <https://github.com/spbatgit> if you confirm that the issue is cluient to client we can close this one as duplicate. — Reply to this email directly, view it on GitHub <#30704 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHP6XX7NWLGIKTETS7DRVDTZJFTIVAVCNFSM6AAAAABJ2CVW6CVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCOBYHA4TCOJSGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[rmartinc]

No problem @spbatgit, in my tests the issue only happens when doing client to client exchange. If I use an identity provider I can add scopes as before. But as @mposolda says this is a duplicate of #29614, I have been checking and there is no more changes in the DefaultTokenExchangeProvider that can change scopes. It can only be the PR for issue #21578. I'm closing this one as duplicate.

Duplicate of #29614.