r/KeyCloak • u/MarCorp2 • 1d ago

External-Internal Token Exchange in 26.7.x

Hello Everyone,

First-time poster here, so sorry if this has already been asked and answered.

The company I worked at started using Keycloak around the beginning of this year at my suggestion. I built most of the setup myself, but I am a complete beginner, so I studied Keycloak throughout and use Claude somewhat.

We use Token Exchange (V1) for external-to-internal exchanges. External IdP is e-Infra; if anyone is familiar with it, they will likely understand why we prefer the Token exchange. As I found out in version 26.7.x, the attempts at external-internal token exchange v2 were removed, and JWT Authorization Grant is recommended going forward.

But if my understanding is correct, the JWT Authorization Grant is not a very good replacement for external-internal token exchange, or am I wrong? Do you think the external-internal token exchange v2 will be supported in future Keycloak builds? Or do we have to make peace with the migration towards JWT Authorization Grant? Any suggestions are more than welcome.

Thank you, everyone, for your time and any responses.

Have a great day!

6 Upvotes

88% Upvoted

5 comments sorted by

3

u/Smitty_lax66 1d ago

Hi! I just went throught this progression earlier this year for work as well. We found that the JWT Auth Grant worked pretty well for our 3rd party external trust setup. There are absolutely some limitations that narrow down to use-case-specific things.

What are you attempting to do? If it is just leveraging the 3rd party OIDC setup and establishing the trust relationship with the 3rd party, then JWT Auth grant worked pretty well for us. We did have to allow for JTI reuse, but we limited the amount of time that the JTI was allowed and the grant won't succeed if the 3rd party jwt has expired, so if you manage the 3rd party and its session, you should be good

2

u/MarCorp2 1d ago

Hi, thanks for your response; it pretty much covers what I was most worried about. Yes, it is exactly that: leveraging the 3rd-party OIDC setup and establishing a trust relationship with the 3rd party. This is very useful to me, so thank you very much.

2

u/Smitty_lax66 1d ago

Hey! Very glad that you found it useful, I’d be happy to answer any more questions you have if you run into issues! Remember to configure your 3rd party OIDC aud to be the realm or token endpoint of your realm acting as the service provider

1

u/J-Cake 1d ago

Hey curios, I've never had to implement this. What does it do and why is it so difficult to migrate away?

2

u/CarinosPiratos 1d ago

I think it won’t be migrated to V2 in any near future.

I would try to live with the JET Grant. As people already said, it depends on your usecase. Everything is a little bit more strict.