Description

There will be two users (user1 and user2 for example), one will be configured to allow delegation (the administrator will be configured to allow impersonation over that user using FGAP) and the other won't.

The first scenario is a normal public application that is initiated by the final user. This application always request delegation for the same app service account that represents the administrator role.

1. A public application (JS application that uses keycloak-js for example) that always requests the parameterized delegation scope delegation:service-account-xxx. The obtained access token is used to call other endpoint that will perform the TE delegation.
2. Another application (sprint-boot for example) that receives the token generated in 1 and performs the Token Exchange Delegation. This application should be protected using JWT (bearer only app) but uses client credentials to obtain the actor token using the service account.
3. Note the audience in the subject token should include the app in the endpoint to be a valid subject token.
4. The demo should show that user1 obtains a valid delegated token and fails for user2. The service-account of the application in point 2 should be configured to allow impersonation over user1.

We can develop just one spring-boot app but with a public part that allows to implement the public app in a public html or similar. But this is up to the assignee.

The apps should be simple, don't spend a lot of time on then, just demo purposes. The idea is checking if both scenarios can be implemented or there are gaps that do not allow or simply complicate them.