Standard Token Exchange - Requested Audience not available #40870
Replies: 2 comments 8 replies
-
|
I've managed to workaround this issue by adding the |
Beta Was this translation helpful? Give feedback.
-
|
Iβm experiencing the same issue. I want to exchange a token issued for App A into a valid token for App B. Both App A and App B are confidential clients, and App A has token exchange enabled. When App A sends a token exchange request with However, if I make the token exchange request without specifying an audience, the request succeeds β but the resulting token always has: What I donβt understand is:
In addition, I prefer not to assign a special role to every user who needs to be impersonated, so the solution mentioned above is not relevant for my use case. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I am trying to setup standard token exchange between multiple clients, although i'm running into the following error:
{ "error": "invalid_request", "error_description": "Requested audience not available: <target_client_id>" }Version

v26.2
Both the initial client and the target client have authentication enabled:
The token from my initial client, only has initial client in the audience, although I want to exchange this for a token minted by the target client.
This is what im sending in my request body:
Is there anything I need to configure within keycloak to allow these 2 clients to exchange tokens with one another? I thought FGAP is not needed with standard token exchange.
Thanks
Beta Was this translation helpful? Give feedback.
All reactions