Introduce dedicated delegation permission for token exchange delegation - #51520

services/src/main/java/org/keycloak/protocol/oidc/scope/DelegationScopeType.java:72

• Client policies cannot authorize this path because this overload supplies no requester, so evaluation from the actor's UserModelIdentity has no kc.client.id; ClientPolicyProvider only grants when that attribute is present. Pass the intended client into delegation evaluation while preserving the actor identity, or remove the documented Client-policy support.

        if (!evaluator.users().canDelegate(currentUser)) {

services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionEvaluator.java:133

• The earlier canImpersonate() Javadoc still links to ImpersonationConstants even though this change removes that import, leaving an unresolved Javadoc reference. Update that link to AdminRoles#IMPERSONATION as well.

     * Returns {@code true} if the caller has the {@link AdminRoles#IMPERSONATION} role.

docs/guides/securing-apps/token-exchange.adoc:371

• A Client policy cannot authorize this flow: canDelegate evaluates with a UserModelIdentity and no kc.client.id context attribute, while ClientPolicyProvider only matches that attribute. Following this guidance silently drops the scope, so recommend a User policy for both administrators and service-account users unless the evaluator is changed to provide the actor client ID.

NOTE: To restrict delegation to specific users, select individual users when creating the permission. To restrict which administrators or service accounts can delegate, use a more specific policy (for example, a *User* or *Client* policy).

services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java:144

• The new service-account branch that injects CLIENT_ID_ATTRIBUTE is untested; all delegation tests use a regular administrator with a User policy. Add coverage with a service-account actor and a Client policy, including a nonmatching client, to verify this authorization path.

        DefaultEvaluationContext context = Optional.ofNullable(root.admin())
                .map(UserModel::getServiceAccountClientLink)
                .map(root.realm::getClientById)
                .map(client -> new DefaultEvaluationContext(root.identity(), Map.of(CLIENT_ID_ATTRIBUTE, List.of(client.getClientId())), session))
                .orElse(null);

services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java:144

• The new service-account-specific evaluation path is not covered: all added delegation tests use User policies, so a regression in Client-policy matching would go unnoticed. Add a delegation test using a service-account actor and a Client policy, including a non-matching client case.

        DefaultEvaluationContext context = Optional.ofNullable(root.admin())
                .map(UserModel::getServiceAccountClientLink)
                .map(root.realm::getClientById)
                .map(client -> new DefaultEvaluationContext(root.identity(), Map.of(CLIENT_ID_ATTRIBUTE, List.of(client.getClientId())), session))
                .orElse(null);

services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java:144

• The new service-account/Client-policy authorization branch is not exercised: all added delegation tests use UserPolicyRepresentation, even though this path and the documentation promise Client policies for service accounts. Add an integration test with a service-account actor and a Client policy, including a non-matching client case, to prevent delegation authorization regressions in this security-sensitive path.

        DefaultEvaluationContext context = Optional.ofNullable(root.admin())
                .map(UserModel::getServiceAccountClientLink)
                .map(root.realm::getClientById)
                .map(client -> new DefaultEvaluationContext(root.identity(), Map.of(CLIENT_ID_ATTRIBUTE, List.of(client.getClientId())), session))
                .orElse(null);

services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java:143

• This service-account/Client-policy evaluation path is not exercised by the updated delegation tests; they only use a regular user actor with UserPolicyRepresentation. Add a delegation test using a service-account actor and an FGAP Client policy so the new CLIENT_ID_ATTRIBUTE behavior is verified.

        DefaultEvaluationContext context = Optional.ofNullable(root.admin())
                .map(UserModel::getServiceAccountClientLink)
                .map(root.realm::getClientById)
                .map(client -> new DefaultEvaluationContext(root.identity(), Map.of(CLIENT_ID_ATTRIBUTE, List.of(client.getClientId())), session))