So what ended up working is:
Add Audience mappers for each client:
(Obviously in Included Client Audience, add a real existing client)
So, supposing we have potato-client-1
, potato-client-2
, potato-client-3
, we would create Audience mappers for all 3 and add them to the scope we created earlier. The list below would have 3 mappers in our scope.
Once the scope is set, go to the Clients > Select your relevant client >Client Scopes tab and add the scope just created to each one of the clients (potato-client-1
, 2
and 3
).
On your code, you should now be able to exchange tokens between the clients, passing the scope you just created. Please note that the client ID and secret should be the ones of the target client, so, if your currentToken
is from potato-client-1
and you want to exchange it for a token for potato-client-3
, the client ID and secret need to be for potato-client-3
return this.client.grant({
grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
client_id: config.clientId,
client_secret: config.clientSecret,
subject_token: currentToken,
subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
requested_token_type: "urn:ietf:params:oauth:token-type:refresh_token",
scope: "openid potato-audience-mapping"
});