79522655

Date: 2025-03-20 10:42:53
Score: 0.5
Natty:
Report link

So what ended up working is:

  1. Client scope:
    enter image description here

  2. Add Audience mappers for each client:
    enter image description hereenter image description here(Obviously in Included Client Audience, add a real existing client)
    So, supposing we have potato-client-1, potato-client-2, potato-client-3, we would create Audience mappers for all 3 and add them to the scope we created earlier. The list below would have 3 mappers in our scope.
    enter image description here

  3. Once the scope is set, go to the Clients > Select your relevant client >Client Scopes tab and add the scope just created to each one of the clients (potato-client-1, 2 and 3).

  4. On your code, you should now be able to exchange tokens between the clients, passing the scope you just created. Please note that the client ID and secret should be the ones of the target client, so, if your currentToken is from potato-client-1 and you want to exchange it for a token for potato-client-3, the client ID and secret need to be for potato-client-3

    return this.client.grant({
        grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
        client_id: config.clientId,
        client_secret: config.clientSecret,
        subject_token: currentToken,
        subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
        requested_token_type: "urn:ietf:params:oauth:token-type:refresh_token",
        scope: "openid potato-audience-mapping"
    });
    
Reasons:
  • Probably link only (1):
  • Long answer (-1):
  • Has code block (-0.5):
  • Self-answer (0.5):
  • Low reputation (0.5):
Posted by: Tyrannogyna