keycloak/keycloak

External-to-internal token exchange doesn't work without user info

Open

#12,546 opened on Jun 16, 2022

View on GitHubContributor guide
 (12 comments) (4 reactions) (0 assignees)Java (8,346 forks)batch import
area/token-exchangearea/token-exchange/federatedhelp wantedkind/bugpriority/lowstatus/auto-bumpteam/core-clients

Repository metrics

Stars
 (34,398 stars)
PR merge metrics
 (Avg merge 6d 19h) (384 merged PRs in 30d)

Description

Describe the bug

I've set up Keycloak with Azure Active Directory as an identity provider. In settings, there's the possibility to enable or disable the userinfo call of this provider. Since Azure requires a separate scope to make that call, I deactivated it. This works as intended for a browser login, however, the token exchange fails with this setting.

Version

18.0.0

Expected behavior

The userinfo call should be optional for token exchange, too.

Actual behavior

Token exchange isn't possible without it and there is an error message in the cli telling, that the userinfo call wasn't possible.

How to Reproduce?

No response

Anything else?

It works, if I turn on userinfo and use a token from Azure that allows the userinfo call.

Contributor guide

Research direction
Investigate how token exchange handles the userinfo call and make it optional when set to disabled.
Tech stack
java
Domain
backendsecurityauthentication
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
JavaOAuth
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40