Skip to content

doc update for dpop and token exchange#51043

Merged
mposolda merged 1 commit into
keycloak:mainfrom
graziang:issue-50963
Jul 21, 2026
Merged

doc update for dpop and token exchange#51043
mposolda merged 1 commit into
keycloak:mainfrom
graziang:issue-50963

Conversation

@graziang

@graziang graziang commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Closes #51004
Closes #50963

Copilot AI review requested due to automatic review settings July 20, 2026 14:56
@graziang
graziang requested a review from a team as a code owner July 20, 2026 14:56

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Documents sender-constrained token behavior in standard and legacy token exchange.

Changes:

  • Adds DPoP and mTLS support details to the comparison table.
  • Warns that legacy V1 emits unbound exchanged tokens.

s|Consents | Allowed for clients with `Consent required` as long as the user is already granted consent | Not allowed for clients with *Consent required*
s|Authorization | Verification that the requester client must be in the audience of the `subject_token`. Integration with client policies. No Fine-grained admin permissions | Based on fine-grained admin permissions version 1
s|Revocation chain | Not available for access tokens. Available for refresh tokens | Not available for access nor refresh tokens
s|Sender-constrained tokens (DPoP, mTLS) | Supported. See <@links.securingapps id="dpop" />. | Not supported. The exchanged token is issued without any binding.
Closes keycloak#50963
Closes keycloak#51004

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
Copilot AI review requested due to automatic review settings July 20, 2026 15:15

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

will mean that the access token is valid. If the subject token is a JWT and if the provider has signature validation enabled, that will be attempted,
otherwise, it will default to also invoking on the user info service to validate the token.

WARNING: The legacy external-to-internal token exchange does *not* validate the `aud` (audience) claim of the `subject_token`, so an ID token issued by the external identity provider to a different client will be accepted as long as signature and expiry checks pass; restrict `token-exchange` permissions to only the clients that genuinely require them.
s|Consents | Allowed for clients with `Consent required` as long as the user is already granted consent | Not allowed for clients with *Consent required*
s|Authorization | Verification that the requester client must be in the audience of the `subject_token`. Integration with client policies. No Fine-grained admin permissions | Based on fine-grained admin permissions version 1
s|Revocation chain | Not available for access tokens. Available for refresh tokens | Not available for access nor refresh tokens
s|Sender-constrained tokens (DPoP, mTLS) | Supported. See <@links.securingapps id="dpop" />. | Not supported. The exchanged token is issued without any binding.

@mposolda mposolda left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@graziang Thanks!

@mposolda
mposolda merged commit ce85634 into keycloak:main Jul 21, 2026
68 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

3 participants