Description

We must add the issued_token_type to the access_token_response for token_exchange.

Discussion

No response

Motivation

The RFC8693 requires that a successful token-exchange response cotains the issued_token_type field.

However, in the current Keycloak implementation the required issued_token_type field is not part of the response for internal-to-internal token exchange.

Details

Example access_token_response after token exchange:
https://gist.github.com/thomasdarimont/e2082fa7076f27dae42efd8f5d16785f

An example for how this should look like can be found in authlete. Authlete lists the issued_token_type field in their token-exchange documentation: https://www.authlete.com/developers/token_exchange/