After some efforts, I still unable to reproduce the feature of direct naked impersonation with OIDC.
refs: https://www.keycloak.org/docs/latest/securing_apps/#direct-naked-impersonation
I got same errors.
curl -X POST http://localhost:8080/auth/realms/iot/protocol/openid-connect/token \
-d "client_id=backend-service" \
-d "client_secret=f0ead74d-c3eb-47c5-82fd-d8fccc5e5096" \
--data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
-d "requested_subject=1c04c634-a64a-4905-b87f-e654ca01b889"
{"error":"access_denied","error_description":"Client not allowed to exchange"}
below is my development configuration.
$ cat docker-compose.yaml
version: '2.4'
volumes:
postgres_data:
driver: local
services:
postgres:
image: postgres:12-alpine
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
POSTGRES_DB: keycloak
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
ports:
- 5432:5432
keycloak:
image: jboss/keycloak:10.0.1
environment:
DB_VENDOR: POSTGRES
DB_ADDR: postgres
DB_DATABASE: keycloak
DB_USER: postgres
DB_SCHEMA: public
DB_PASSWORD: postgres
KEYCLOAK_USER: admin
KEYCLOAK_PASSWORD: admin
#JDBC_PARAMS: "ssl=true"
ports:
- 8080:8080
volumes:
- /etc/localtime:/etc/localtime:ro
command: -Dkeycloak.profile=preview
depends_on:
- postgres
realm-export.json https://gist.github.com/whisper-bye/20c86de26459efe641008ba5f448f3f1