From b6fe6c2db885f5535fdb9260f14f1b99cbaeaaa9 Mon Sep 17 00:00:00 2001 From: rmartinc Date: Wed, 25 Mar 2026 11:44:59 +0100 Subject: [PATCH] Documentation for brokering API V2 and make it preview Closes #46590 Closes #47259 Signed-off-by: rmartinc --- .../java/org/keycloak/common/Profile.java | 2 +- .../release_notes/topics/26_6_0.adoc | 5 ++ .../images/retrieve-external-token-client.png | Bin 0 -> 16239 bytes ...rieve-external-token-identity-provider.png | Bin 0 -> 21577 bytes .../topics/identity-brokering.adoc | 1 + .../topics/identity-brokering/tokens.adoc | 49 +++++++++++++++++- docs/guides/securing-apps/token-exchange.adoc | 4 +- 7 files changed, 57 insertions(+), 4 deletions(-) create mode 100644 docs/documentation/server_development/images/retrieve-external-token-client.png create mode 100644 docs/documentation/server_development/images/retrieve-external-token-identity-provider.png diff --git a/common/src/main/java/org/keycloak/common/Profile.java b/common/src/main/java/org/keycloak/common/Profile.java index c7f5226a645..d42a6145fcc 100755 --- a/common/src/main/java/org/keycloak/common/Profile.java +++ b/common/src/main/java/org/keycloak/common/Profile.java @@ -174,7 +174,7 @@ public class Profile { RESOURCE_INDICATORS("Resource Indicators for OAuth 2.0", Type.EXPERIMENTAL), IDENTITY_BROKERING_API_V1("Identity Brokering API V1", Type.DEFAULT, 1), - IDENTITY_BROKERING_API_V2("Identity Brokering API V2", Type.EXPERIMENTAL, 2); + IDENTITY_BROKERING_API_V2("Identity Brokering API V2", Type.PREVIEW, 2); private final Type type; private final String label; diff --git a/docs/documentation/release_notes/topics/26_6_0.adoc b/docs/documentation/release_notes/topics/26_6_0.adoc index 32295dd68ce..c49c8f528ed 100644 --- a/docs/documentation/release_notes/topics/26_6_0.adoc +++ b/docs/documentation/release_notes/topics/26_6_0.adoc @@ -223,3 +223,8 @@ Tests simply declare what they want, including specific configuration, and the f For more information, see https://github.com/keycloak/keycloak/tree/main/test-framework#readme[Keycloak Test Framework]. +== Identity Brokering APIs V2 (preview) + +A new preview version 2 for the Identity Brokering APIs is introduced in this release. When brokering is used during the authentication process, {project_name} allows you to store tokens and responses issued by the external Identity Provider. Applications can call an administration endpoint to retrieve those tokens, that, in turn, can be used to get extra user information or invoke endpoints in the external trust domain. The new version improves the token retrieval endpoint to accommodate its functionality to substitute the internal to external Token Exchange (use-case for the link:{securing_apps_token_exchange_link}#_legacy-token-exchange[legacy Token Exchange V1]). + +For more information, see the chapter link:{developerguide_link}#_identity-brokering-apis[Identity Brokering APIs] in the {developerguide_name}. diff --git a/docs/documentation/server_development/images/retrieve-external-token-client.png b/docs/documentation/server_development/images/retrieve-external-token-client.png new file mode 100644 index 0000000000000000000000000000000000000000..63a7f6214de45b0be0d8fb40f90718e6c75b414a GIT binary patch literal 16239 zcmd73Wmwc**e^Q511KRXr68fwDag<*Aw6`5;?Ug z>^0B(?)q@{`{i8woG<+0Vg}Z%x_@j5D1a{D`|BI1e+9mzjYfId~LIE zLVyQ{tBkJeOK13NS1Sj5I!!A(I7A2jmW~HXr~KNPj^{ZKAKi07A*g^5FCU$xGTloV z%_&jd2jGp5FmKdwFn9HM?F@%l*gM$4Ib6(~;c$BwO9$6I><%#qL~K%CT2j+9V|NbE zGhvLP`#?iNMna-+M^rkoV40lsp5%Q;y0D`dpGB$1i{xYtPf<|@(y-*GPZ7QMV%y@{ zzSv%088vbfS*5qvDjT$CZ}cYcdezM5?~0yfxGaeHJa`1g0r@Ak8}p!}!@_(}$h-S6 z%;WaQKrHZ(F#QMfks(;maxjm34{zasN8q>H%$Ohlk(Iaw9(2$Dzj`ZO=obI$OrrGm z&R-mpZ(OwPYoO^K(VAAgjLrkV^2mAAKPxKMPAr=2pjl8h>Qs=%kUid}@t8 z1iQt#zHx#r@ckio@$FWAdVE7HHbfR$L_P>ALocVYZ zYCZZ@ug1J7d!s+yf{aaDsk(o>++cVAJ8?r-2*J#Boz0w^MV41#)MLTn>+=<2Veo}R zm{P>^Yk!vLjD72YEFyuae*XLcgTiEA65DRgfLM+D?zEl?ul=k5mAHRvrrWrlc7XyJ zq69N2jbCpWPo*J-lTxnRsXhCqT^6*n zT0Ui3nNp`}Us(AzdYkK4`ahuZ5zQ(MAwg05=v|+(`DfaV6B$#yuem)?hUq-;h~3Gm z?_k^h3bT<|!VUwU_E%=WekWeIS=`)*O;)Xvw{|o2(8sN{X$h2HM|2X03;j~462)g_ zT?MBv7SuXo2w6i~SK}4Stj9{+ zhvk`?Y<1T9l6GfZ2I`)?{O}M0d1c~6z&u`Q;$Y%;l0?R3Jezct;eWAJZ`z5agHJm8 ziQBBq4LR<<8YkCm9GoTUGkv-{^Ri*VWk7Vi)=I;m+0|;Z88z3^f?OZSrfo*W$;l{3B$D2c_dORA>Z&$txerG>h9W-VFuInGYFrQ3N6|<_d9;@~~ z*`69v70;xPHL5X>5WrIb#?9)t#Uap0l;`hQmYn7!=>EXjdZ8!XxO5(>h z7URr`+j*8$cBN=~mZ<5oPu~5aq3l&3Pj?#@^byG%M%tgvx}#60Z7QciY5gr5=DkbN z*UT@9_MU+?5eI8BA8_NR6FQ&!5)Y9n+#pN=X9@B=oAcQH_~Osk>nrq(njG~SE-9ri zpUwDhKD+7FdKOqtAQ2VcZ|FNjg;C4ST8fGL1Q8`K^Rez;>ru3FI$u8#kZs<{KCuj2|n-Z zfSaoc&enY?MddOyU%}OeL(59E@T?sx|A^b!ypKbCAQJ2xH=_MK*{EvgwZ5i_qEtK4 zo8PG~II>(b!jDN9K21^(@-k-+T+ADOhd+H&VCP0V$A4LMY1YAQodkc2NN(S_$kf!9 zde^~-dpu`7-`YfAOjc&>Hl}5-hKEB5%7fnzjvP<)Zo`}x`gC{hZ$XOjwl~Yg2{PsF zA{7Djz}RQE&OTPqaZ!ST&@!j;-TUg>nZh3KGgiO!5_|6vJ><8YT+GtJb{^Wf`79G@ zNEiPAj>CILf+<=JE*jcZ~Kk`$w9+KDJ8N8OzwC@5JJ|xl%qBeo2yp z1ODQkl$)$JpKmqt2n<;+mg=45#fVLdhT^KRX_qRY_HR%Q_NTt+_A~BN z*>c5oy9vn~xywS8dzP;ha#}^XG*fG} zf|Uw3D`Htj?%SVOGv%GBj@7Lucd}tpCC}yt7_w}+8;%P*^rTb&wqc4z^b4@`J!v%^h2=9P2 zCkps2>0l2v^6r6qY%l34i$cYd6`~F|2KG4FR&pPi5amM~Rkxt|?&5HE($%6epk9kPzk%vP^67PRdUNGHaQYbWC z@W|7e>*7ulWRN=>GkY&ycxJZj(-X!X5~PTe#;SD`DMByT`TjlLq(qg*6@+D@2cRc4%}RR06RCgP3pAVUsr8ET_AQhTf<9OY9ss%*M^!k!4c&Ah_Y12 z{(03j-rjz((vLE!VMhbv3rTg%$VEKjjSLr+h=DCch6qutOmN!%S$=|c&0)h&*29Cm zgMs2l=ldHYK8Xy9r{iTd&nt~@^=~8VEX|E2lN4TFR<|HhxI8wdO_pNT&@`83G75;R z#341oG@fUDSm%pe<7cVKepHC-gztBS*?A!+*hX+&O`CvOr|u>R9Z7^7t>3DBC&8yDNqG zZ)f=z+fb}Kg3DpgW}A2jtRdqzFujlFds_GfX84wLxs*QrIcyK*36hAyd2mwQ76orI zw(<5;KdcsYOX^|c*swwmCuGEu`+g=0Dj;pb*8EG1bo3I7?i(`UkXMPxneQ6-F_Aj5 zP%Tq!)^xF-WF*b7`_ZRlPWlKHSW61Sd}z%U%(kn}s7v4cDX~Lm*~bvv9*M-#IobQ6 zFvEH~+?V>|Zs}Ry$mcuwtz(sW9m)`hX+UaLF6?hy^(|ImwH3!z`2xoHWUxK{8QS@5 zA}X&Lu;+tM`aEneZy!$FC(Yb=z{XL`xZsdLjxWJ0T=GtNm6b=V=*|Yhee^MP;@*)b zs%azs9}R1%XhRPZ(YyF1nv|a@UD}L0D!L@spt3G-gpM17yjq0j^HLORw8EhZPIYYvp5Pi#G$FWTThn3YzeEW zG$+-PE1!aA+60z(d#lQ=Yg@g?T}&%DmNV0qSW>j{4UE^OoQyOV&{EIUiW+@bv7xs9 zEF-`ePNYebPxG#J*k>$Ihe4^E#;44HQ421U1|Ne=p8XRRbSKG)`O^rUF@xw*-MV)_ zC~a<2=>W1eXOHpcAbt1Al-bWTxI!EV_eQ?N5ZI$SZu}_-i&#WjKlaeF7~wUJY;2?# zj#N7kC!Q7AG$l_RX=S(=-LtXM47dy&Eqc3@?$BNZD*ogN+_G1d zBcWtUw*MoN`}^N%zY`Tt%8ZC=vM5SuHJ#??0=NNmaAI2upHx$}Kn!Prch{=WsOF^a zp`~Nl^#?lMSRF>$t0$H17bR?L>H|G2Uow`HSBN}Dl=(wALsNvqwciZKHP%I$o1I*Y z{wSB!Q7BNVnpKS|r~GEMr9xY_C2AwXL^N4Jt1Pi7fkmc#_O?Y60O`@u1jt^G5p6okhy_f8CA>uUFS#NArmmIhlxxi`hJI zU=oGS`KME~O50a{#oZay>bti)-!f{myp@M6G3ZWEoPM`?gm7-T>`yIuJ>xSxD zBqaJl01)hOjigte@KVu>6^~i_SlF8at6(GyRHY+I;6x9w^H)nFB~=332s>c~3!mTa{x48|?pC+;ly3p$;P~x=*X*z4l7Oxq(k=iB|v#h|rs8DUU$be`ss4J*A#C`D&~d_|W_JSBZICr<#U?-9WE0a;Dbtj0?1S_U z;doX|D+hPfXW(>BodC1eJmV(OryHXI7`J-LiZ^p$Mw!9Q&(j|{aB{<18hoSqwmk{g z?YzmgKL%qQZ~PoYIoETfI)8*zDplVinP~LCgGln(^Xi(Xi9j1XhQ}De#_iJQMM;M& zPhNDCeXS<#(|)^pbPMA6^=S^IIu1j8lkga6C6b>O1il$)&v`R3j|hJ!6O50u({xvB z_jel0S^TAlU)0=5uPs%B=}5c8Q>VqOMeK<8KX!iP@*N$Rl@BiY=+Gek)d=3+1v8uO zst73$N=n|EZa9H&a+9Y?X&wqIKytDbx67IP+R{W0-YNhGmG*X zt^kv3lY#fU$n@I=Q}SOLI4ezcvh`1MNRj@ zS)K+*e9eBj@%lj*c0}8k&p3y=F?{fZW2M+kaD8up`FDntUyr(Ms{5F&mOR9cWY&uq zTzeZ7(PPIz`j9zR;D=DA_HUHfms*2<7M@r-@J}TENK4#WeSXDQR`YsW4tF7v$2w2Mo?fe7i zIMpp2$5{NEv9px#16M55yT-MqPwMD`fY9^rLAok=qrJ>-!AW$e)9H}Ojk zR*{FV%0r)yBQaC;ASLk4>CV)6g^{rE)$s^69;skwWyg&bt>2~I=7vbPr1aKsf$hpK z<$CuyA%l9~CgJ|JAB$UdQ#qRN0hE84{a#=Goj{&6}SQl(CQA^r}eDkV7Dk z4SCu^KZ8kd2W6xQp;4$*Rj8caJTh9W@p9(lqZhyQ8|>}mXuR@~37bDO7WDO6!p8#aUbGN{$? z4-BPRJz!GJvQ05^PfcRe`4d6PvdqH{aBt)8bRA;&&F@K*mz~l`ZI1FI4u0K&2r{Y8 z_oT|cmy8zBY9^Xpd-#JI^26!$J<5B;RmZB}-VD}AM!=Yv8v(JlJ44NB*O)6)xEAS1 ziBbS|Z&VEz$54@$1)wE3%(ZxU1ZSw_$xi*<$aX+ZR5qAJ3;s%G*L!2s;$HXq`-dq& zQrR8mTTx!eH8eVsA@y1s$6#oiDp%+;j|ncL=21$1d)rc-%KAvo=AH<0j&1u17ochN zs0i=Yewtq>>`%AbB>q0P7RhC67xib-r^9N*VsbH8eDaWtjYBm{M7w2t$X$EoMfuzC zW%q!ImYwxK9xaDoo-7d8toNq@#1Dxjd+Yr{s^%Kh2KSUC?(?Nk+Sy|5a(zxm7%Y~{ zM2t$nF$cr!$+?Ve`_uUwFk*|42kNnR#=aK(;&j(W$JnbN)Az6!RRx%#r9r)Il_F=; z5BRgh1DI*Gh?9i>faqDH9gW}d5PhYh}f}-FAi0i$$9u?i}}s|{Si)L^!#A( zCGk{>iN6&_4)FQi8I0HcSgB{Uc*ICBp)cL{d2Y5(+i7xts<1e>Vm0OfIpmSlJk0jL z*4p&noiSSd)2(`rQJ(|Lo+@%smA-4{!3D}$N}c6Umyu4HE;o8Hn0R(=Kn!i$p>K~v zvpdt!05pi{*e5RypFjB?O56Z|oZd{m-EN|WiqizObI+4g@Q!A}K<#k+6!8Fmopt(9 z8t)Rk6SM7y-iWizyQaIhWq{A4DPxb+i4+cAa*)HJQh@ z_t`Fremir2Mn|=^e<8qZ(i$TtONhXW1Et_HpF4d7PQ;7e%Ik%K?b(d9l8BHy0 zxcAaia5RF9ZMI1vx67ujE-JaysMb;~qVlJBasW+|0E(QbmZ)QG+ zdE2Tq{(yF2F0Jafo6Xx}C6l`i^P4I_RH>=zxFl~bU%ZcVx*NP4UdhtYayhWffKlz= z;^?vFFl!dY3ZLoSQoR*OOdl<KOrO zm%Ti37nYjfEtpuqY~0$2%=JW;H@xvDOoGZcIm6Fd?AFT!Pt_|YY)3zt%nn#jp6nbhCsBut&~@lk8rz2y z9{mv>F#r8&sX_<4&YOGGB$ozX_0b2dQf<9^HsfVZa19QF`dXj8wh7Vt%i|GMZgJT< zzXHW03iio8J~*pBuY>h2r#-SSD=lkIpm$g7g<72g88#R}bx>p3p=P_U7lmfg9rPdJ zJ=anWBaB1?WxyfQca!gwtTFGOrMn)}F>#wY+Z=kfy;3}DwbT`II;x@Cl=ZpaWG3*Pv;F){gLPsM1TOO7F7>vtTv_7PptVYhv3IeN=Tb<$`>y_3voxFh z&k}{T2zl>kU0~$=FY;)@5AQ!B#38x4Mpw2Nwi`bB&(Zxu8bUzfu7`s|!qvJT)S{A# zo5YP#9#3~_2AXH&V!-93;dlU~>=rY1&-RASY_`Z;#+|c;fCZ>)%tP)j_FlKN?h(XnaxO7FTJi_Q4J*9xzx7M7dZ~vGJ9SfUXdB~ykwwZUFzWq` zATxS-{4VWU!mEjuiu!M zx9f^gKqSWF5s+18*8U+|p*MMcNrr+XXdZv{3qx>u5!|r6dmJ{LF5mt< z6AVBj*nx>l5R6X#(8Xy_HK`tQ#GTeEVAnWRGE2yhlIU! z1le)1U0SY^Db#CUQ&mU01kYlAOKfebPi&+Bo{p-(23c$D^ z_a*|R@SXz`CJAakJE1DRB)hx5*$J0;vf>ba|kzkSjH?i+dI zfc)H-q544S-kJB=s~ctBrxf#T1fXk#)Ah`Isbzo;y0i(u1_Wby$(spq%SIuGM#1BpMd}lA!BFm|x z^ijwF4&)wZ1p{zljuZORpa@`s*?{s?2XyxV8n4y+FE26B4gg%%7J#o3%D&$KzS?A3 z0U%y3^5SgI0m$I>pcpOS$o2^G*-n}QpF@$`)1=9{0DYzGK$#d#gSOe+NZ!aIX)cpQ z<~$K^MBrD^WXBQ}@G-Dsa|G}(nej_d^KAm)p6~-0u18&$UfFF7lhL0V%N=r10 zqW!FtsI zdfly`v9AGO>utwGPIdNP$IblpHQGTK_)l|$0Wg3X-O)0Y44A|6M{t9_WfwRYy8xCp z09#Hs`~idE2T8r)?{{a=112>g)0Js;n&Ap5oJNLQx?p8?*V7&9f$7t@OFD=_H-2Ky z^IjWG*h)q&{m}7tKc9y3EM(n;u}cH8=IDwPpu(mr;M3R#Agj2VH=oWlI_0%p9wO{b zJXsHh+sm{{liQAm6+fI0d%Rq*@v8tXQY|oDI9=0uh)I}KY7dyuWWR42u&3kHsfQ8n0r2(*=@Y$@3QFzWp z^d(xS_{-@Q7|qsc)afqfepuxO%m+#H^3hZHRbMhk`uawAeVcy+^hwTxky?KmWA`gV z2;JI1)OtwsQ!@V=AAYqg9OvOQMXQl#Cf@OG{d zw|5)Q>#&z;?ugA)2xB^jF(@WCc1|nv&#eaG`=yR$(Ci{AC4Yu9Wm(et9mf$cx|+0| z0jXVFGosq(%>GP_EUMH&20LJ`P(pr95gYf1_EA}&QcQxnavL)u|6O!F;CiYFv!}nP z92$`}qeZX7xcmlG1(yEt0l?J`5JLB@f|O4g~*~_vub*;YRprGsb_LAjzXMezyXO zF-OtPX%j?({%T>wlNma_4o(JNKD+&`kQ+x{BnM?rQOakN4*%Y34W(%F^~5_pDO}l+ z0?=2(5`|tz>zoF;soq1|uRbe%IDaG|S{Z~hlw&>gS%&l8eK=QQ)F5F?#e{?}04J#I zCLXLbJBq87330pri<7O9?voFjRmQ#tG6Yh4a(gca@;1hhgH2dzj+8l;bX9gUd}r;v ziz6j!eZMZjm1n<5p(6R-o0|9DP~adj`AM40)T6mdSgsVxg6Qr^%}qv^R=NJzocnho z{>E&ww_6r|xXypqQd(SyK8lRZu=%KcHSMIw*80&6tm-B61~N-Autq51{NK87?`@uJ z4t>9}x4c)n*9TZoD!otcUM@L>=T24k4!C{Y7sNT9I)W)RfW-yt^hN}0EAwvdrBuJ~ zTm0ARyFxE2k-lYlnfo!8k*1cm?#B1qKDZE?!||0}eSw#3k0sfmir)n-zK1+|Ke8Zq zvw_V}Prceo=f^$bqpqw>v zoIL~=n)a>(SmaF#~s$sKF!x?aWncEH9&r4NTyB9y7_*xB;uct;7B>gT@%xw1=4p|s& z(iroi|KdA5sR?SY)i_Q_OmfvBTmYY56L%wtU603A?_GGGi>C7i3wAL)D>$O8pW-TG zmi6Vq=LP5$hv51rGpPwO4*k)#09CXW3Gsy}=~d?7UP*<{^TM5CtP?;tLs5ATY9qPY z1&&jH9EvO*H*EcWG2r^>KF&v>Ef0;DypD89cnThXp!$>(u=PIs7nU(`oS=DrIT zx7ufC4OJjWf`|3_cNJgC-MB&{D^s0_zCu5ZAJB}K>8+Tb^UjnE)AbXUTy}GXZllQ( zqwbyHzwgi%XP#gWICtMtGuxn5?4BQla3$L%;oJ`JW8EA6W~3LDXeq4rE$O~*ab%F# zL3X(}_dSyf6!R<5<*@wznl(fU@s*0qj97sL>|ODmi~@07@OTeTdKs_h*uulzmPF=r zE}aU)cqD18)dPuCz1IE{aA?h{NJme+2I#G>5_YZ=Zk{%lZlHS{nEB^fK=9pOe+{_A>yFjb*60QC>)|z(Q+wx-#*Gkxl4QUgoR+q>K0y-5i3b?_aN5& zxQ??6C0{=NDR z=~t8DKaf6I^mluz7FE6Hv2Rn27Q?q=!#HPF)3wD^$JVk74$s@S7AHU9q%e|5#S_?WGtF)_!%X#31?ws;88(`E?Ww8MMD` z=UWBW?UL?9I`c%=43-HV)Q>BYn+P zLqqGmg9F& zJ|^yy#LR-stwYzTM=Qkm)_CX_SLmaq*yM^;r7GobeP8WONU;6#fE0(@x_10`hjlr$ zWe1O#(lWn5q-(@~DDWjVb(=#QQ_=^Sl^Dg`YBr(|ys@K)ZCMu#qqF4~K4ac;2KE#O zxqDGq_aEr;(p*J?ds6LhYH%B-IoV*zavdJ{8Ff4vbhDJz50-0_U5Mq}W*Ex()nRhuYkfJ6 z4`rQ!LDsTw0&dVI%(@?a?}|3yLi=cntwcp8C3b3We7#J(Z7Eb3pch%C?c%Q>l=2G! zSN^O9aap2dj~JT#$lscL81XRKGl6H|U$+53(8M02zI^beX-7Dw%8pkWk z5oB__lDzqNQ{$=c(s}2gX(83Y8T$>K8rTuPa{_*pj7*5@5ao{~YyoYMOytIS0Q==mrYZQ zZ-w~dCCcxoY9&z?+p1w-9VhAykU03J+?@)l$7-OXEzawEL|Ll)gfJMiSe|0Kr@s^E8H0j{GqLsilb9y}mKj}SKE zmQU*lMfmdm54NuVFI&g+Af^5yA;%(j$ctSeS-M~m2l#Z{G=|Rq`+`^4+_+|2!G3oj z5`F(g!uDyX?pM=yK%*X@ zzZO8t1-9+L{;UI8zd1np1cgD;kK@G^fR=plK2m;NC61hPkV>*W-(MQ9hAT!ke988o z#v$ob%J4xoX}7rBA(*H6MZJ$-Ii+Jv1*8Pf;d7oMpxzu4r&L~Ubap7ouvNp-ogTo;|1s220vn;iwWS78a2DhKj7T~(oFx? zfegVBBHqf@Lj?r;ojZ3h3=v@u6zQEmVBV}!*WQz;^n9&m1+(#%tBIXpXvh+Z<~Z6I z@YrzZxT;Slx>=6o+5th#T1u$(b#sh@c}2&yHyh9?wMsO5;gq8~i^bA%XE&R9 zF{eK57?WYH-gQe|=T|<0So9bcZ>L>pY**QKnr7ra1$W0pYP)FzGIo%dSf|lcTo8TI z)h0Al!zw;24@eFbzvcE$evqiTHWYu9)%ySlXfMcPIY4d3F(_~H`toR?Xuu6vI!)ae zK@T{}eX!uO_<5#YZ%VCV9R-lkn z4L)__?&XzqumjPBL-Q6RKeN`lwDOF1^eeEU5f~$_{pQ-I)VQtr3QQ&#Tnqh+zmz|= z1sPQ`Ecs_0gE@>_C+~tq@JJ8(2o#&SWDbLM`w=tWlQErlFK$)sPz~7(*$jWXj^dyH z3Pk8h;2`Ws@Pb?^$XCL%{Z3Ow4||@WgrF{Lrhft5nY~tu!eYm9!VeprQ3rkk)pOH8 zHY7OKFv}J&RoC?xy{Mw?RKJ0koJ0RDID5`;H-FKf6XZk-owVo!{B?XF&URd#rn_wp zcH&5aZTHI95IX`Be#U@`L3wO7qG{;230qfz{^vH@CfIPIj}7*7)<9>f1MLf#BGAM02+MA9I2spC=6=`UbZ znR<M zMH?s4Y!Zw5uY92Wp-xymAK;i=crAW=m%9P`AQ9}1qvuUn{-a=L024Chkz0D&LAz92 z{izz-Y&YBJ#2GeX!D}^4@8MJR=I5*n%jS^(px9ym20rMufW)=}nT)bl6ol_{M?g+{ zmd+4+zvqK(zjZ0$PxRK8?Ab*lHre9$vTN#;%-h^`mu0xfH2Anu6D=K@P6~Ub-4ET& zXqzM|Q}g;eEdz1g@X>oCZ8YkmHx}_CDfg|vZs_<$tSSbJoQQ_)N#36L`ub(VMVxusS~Ieu z=HH~1_~!Y2A)UXG-uUsts1P2)&yrUlr*6e^FvIE?&euXa)o|~xvGlw5xQz~NC&_H0 z>cy(a@p7X_n)*5p3W#?3EhvLrcN>hH0g4}=s0^!@x)sV55D`MVL+kRJTg@Q`p3Nx7 zpuDV@r3nHm+Ir-0j?vKED|-B}|FKHUct(`t17YY+UxB2a_YQee&QJli*uk=SWMk_npZh zBIB#-;xr=S?2w80T>N{N_;O<3UWL;bFbD%@xQyy{>6zrC;NAo#rYV)q@Z?Bp&08aGfR04+kg@6kMFcSk90fYJDZZS0MA~DoN*P{5TiAu3&ja{CeM0B9tvL9*21VlE z8oX-xyyB38$P{{8`)^cQ5Lt$FG73bxS6;OO3HB5eu4ZK79T>JFYPLzkj}wPezge@5 zG@eP7h9ciGDYy0*&(ms--zxV3d*e%^w)(wj z`wJ-5h{2$#30zF*xt@rXpmq{7h#9^>TJ`?3=~twu&ji;XjeT5HR_mbtS)K93SK6ja zTQD)%Ma#7CmtR}T#~icx-@q!sF$QZIrX2krDDa0|J*OAOaJgslf5~BkTT4`dP!5%- zx2w|3c&W|+sAGxS?f@ZVw(WNjj29|XwX7u@u(!-KyQOm&9>;Jfh>)>r4)&$6*)S-O z{)gAtHyZe6q)>Uh(P`yVJvG!iG1Gn8s@VPvSVEH^2wDz82+5hsnS9@IiT=)$vm3r` z@z_&wHi&yFr{5;jtp{Q%96+%7*S051rG%~ar%(KwteC(wjntcU-)#Y>t=w^`D;EjS zo&#QF`xWlw{{3e!#W#90XMns92SKFjI^_6N8q{XDJKMir{Q9xOgo#g`R+;1e4#r1% zYnMs`bKRR4?RCTS9}zIyx1DI0>Q;TGwnZUN!|Wy-hm0y*4DD>Z-OY5?6NR~pV#jR8 zCruIx>CL(P9cM(3E)nkiTGZu|ZOxd0{xC?c$kqeM+z6CN?LwtTrNCdA^F8XX2RUBN zy)&@?^?}pA6R*fw~Q9No*@983H42=W~41>KuRVz2{^K2{?yojpmv|Tsi;;UW19q>MZ4KQ z6>X=g*R*S2-4`w$dUU#@5u+Emt~^(t?R%Ppl>67@=0H>&=I7)9mD4`f80eQ10Yfbw z4#c|r75k;~o&tOSUh^b-CAT4p(bIh>z7FAuuyt}p-Admg;u z*PZx_X=DQas`CsZJ^lMXUjVq}Aq;)&97ezxEx7*BBfT0ApD`=o+RNhxbkt4hnE1gX z$vLWl*zer20c@$2ITv6Dj(|pxwF-xT>e=zg3>pckp`9X6gmu$b7j zK|I5CPjXF}XnT*tBu&sph4~ZATtPM-k6@U1 zhyB+|Ni;UG$RgH1a02h+&DQ|(HB8l5v~>D5Ho0s}11EKthorfKm=WU+g8y93=Aypd zSsCxT6hhJ5J;75SSD*?u555sBbOP#bB zz;QnROV1RmSb(-0U9#n24$>fTEj3fBDPP+*U@kpu2S9g(_sr{1>h-kVq}2U^f?>83 z7_-k)*3xYd`a{5eOzVnyphP^3`Pg%cjLRd0?Pl8NWTXE6B(4;6|e#_cMmed5O7#46#J zc8pVgpJlhgs5HA*9};=()IaMT16N4l0n<&FRlQSP z1!l4aLl4S=#DOU|T{p-5WV*qDcKXj5^!&)>k6<@IwxY<%syv$t8bRlL0th%R#1vu7 z5Ln?$KzLUba)+0}k?~-ASu8n=_YB`2BM2hx6+azNBPr5_*cmUuvS#sO3+yXluj$%fq|7JNX}& zFd4yns(NBMJ-xLG8ZlV|EeJRwv7V12!vbof8PjaH;E!#49u|jk?x!5v8BeeHx6sYs zW?sf504iF0OLaB`JZvL)!f$*3szA?JC$OmEO=8ONd9*h3vD)m=2`#LSw=lJO`IfN@J+#(AM93n5H LB3&V68uZ@)$7K}Q literal 0 HcmV?d00001 diff --git a/docs/documentation/server_development/images/retrieve-external-token-identity-provider.png b/docs/documentation/server_development/images/retrieve-external-token-identity-provider.png new file mode 100644 index 0000000000000000000000000000000000000000..914129b051135d0aa897e7d0de9df538ecccc860 GIT binary patch literal 21577 zcmdqJXIN9+*Z+wH6)=EQ4N}Dh0xDIIUZwX)7m*seG(!`VE+7IbARxU2LT`b9f>J~} zp#?&h-h>c3vvc3SdFFZMnrp6k_n#SGm`ih#le5p-Yp?HTefNpb)>MX2LMh3}$RJNt z6m-eR&e4&PozcE@0sIedr%DKT;qy>@>LKrLZRug};>@9M?_^B|vwp$xP?$r*(w*bs z{f8nP_aBK1KN5fNh(lI`Ltaro>U_fk@WE@O59+ztcz9d7Ta(#3yEs|%y|i+-wswAL z=i;$(u1SiFOt1Wjf~>yJm$iwDehk>LwyoP4MDuKK?KmzT4qfsyvghxG&qszoCmQJV zMPa^5OTeHxqpWZ`@}%_p-fNwCdzC(VD?NaAp{Vl9#vRXVD` zlyv+jzBfNsN}8NcPYz2M`AtU-2rCO|dZpUm$YMgaX4`NdZmO-$#!8F)bL?91kLi}M zwZPNEbYH)voKItGHIwUXyif0&v$p9T9}pnmsA=nZjx8`QV`$HnaVvt-7x!OxogX(g z5Qa>cn3+En@0_ikf`=G;10JEbzMXU`tMi9T8#562;q&$A*{sZ@9 zbK}=G80!nw0~@lQ5~uq;fkoyR#5%ELW|e~eRyKlvhq&KNC2;;kDn-bCrZK+z4Sr?K zLiqZUWFQ#Wq`Npq6XaE6h=(vV@buW5_~q=6*JsX+TL~Y5p=R2}RM_@-K_(NRXzO1I z6hearcD~C6d1$4-zY=-PZWu+kxaMl4*f`;;A=lMTPmYU0n2C6=o2o^GT5Eg}>ocx) zyyl|``MxxeX9DhlBRB+=alKF}8oJvhI$8UbcC|M{es}5(%~)2fRPv0ix$Adwep<#m z+TV^F><4bG;A%=Vk{;e%-4!1mGnc*fS?&Y0z@Z^DOKwgsgtG2_f?-(|^t)}U=f|#e zY3bFKzP>*GcMx`|an*!7SA0%DAbCMnn@&$8Mtv(&V{nHOdrhZ@(!*j}U5kBLW^O** zIKtAv?aliBM+Y-e0^@LpMI=g&L6d+G^Txl*gRqF)8{M`)_BSjspBO4Knq}j?cXy9< zZT}n@S-az?11p8uPuLA(6lQnq+x90@_lOC%Hr8riqBG2cm0#s(tBu`RTvyl``?cSf zfk8EqXCCUuQ%FF``3_#HU&>7}6=<3H8RgWU{lu9)L%)KPkw@PZB3t+O7q3}XiE=F4 zP_3I4vr4rS&Suh|mi$5z4J;rV&pJN|c+1L9tH3^DpB|kYZmhM?NLON! zu=*bDEI}R~o=rB^1!PI%G8^xp$NKna2wzB&+idG-Fgca!8{#L60JrF8!r#EeU+j+R z4vK;G@P51VZmGg!5(yI+mg!C*wxElZH`IT|WonHC%TEbx;QJ=LL1onoMMD3L#PDlKPMOzW?F?zXVBh%g%+irNyqOEv4 z&!30;SCl~GVgL=LtNHiJMbo?Y70b=IcSLiHnmkUR!VWK}nE5>dQ;>$m<#}m{Uj&A` zBd>x_r3i=Gvlf<>&%OscTUfQeqj(#>lO_$aw-u)eL1o;ZII*sZg2K?rY~x~RFn!GA zjiUpFhYAglOg9kr&n-aI$ZUG(Z}D=%HMn*Rj%vohk-( z!pT-Dgt*lg9)E6riyA|6rWwY*m75&42wdw<>9)vEmGCz1%TzpPsb;C0p}t_Upbc4i zwydKoqdRNd;y0KwNB9=r{k`0}bG4Pl#bZ+XroGcA!`L5RW#5b+-1@$t)aKRyCl@Ggf0=5|4TX~rOeQs_nbVgjH*b)FSj@0oBl_*1W!S9Y;8z+YnTwoLqYnkqGX`P@DkeV~3rKVV88Q46P0@N+`L3`i;gFwn;CXQ-|DJQ-1>1 zc_jY4R`H5(A$AkO%%!lxpI^pKQ9>%s6 zR@8Ciy*2#l9mkL~7S@#D#C+R!`Xgci?Nun3LI!8;#g%5~jcJYX_4F}{9 z0SZx+1;n25IsB-BG9GgwVOT|Pb^zYKpYdSVp$I7=!wW^)%Is7y8xOW4K`Q=0EQk~J zT-NtCFoiAf!ceQwh${FnwPTi&TlUWJPO6Zj3M^UDJWD@nr$B_0uaKbq`8`-}YO&v2 zwqi6al@-5@)gZJLB&nz6-da$KF8k}O1%*B1?U@%B9>yg-ayxsC&cj*1*GVP1asqY2OD`pY9h^rzl_|Ed}Am?!pIz9(Sih)Hz3!mS^E0M_vXL@e~k{QV~CmxE~?g5pSI zXfBk+*;Q5!qDP3yzdA%E%9Fcm<3uOyj+M{IxCK3%eL&850|}G+E+-7Rrr46l5F?b` zNyT8_cb`9&vJpFQrNdX~ClZ>s9MO?~0daD)Z{}9*AT{XwHK~xnSjedW@j>eJ=q0g! z*b0mBX+sHLZ)n~feB14u$Xej7=%IOh;(zeZ>ei-OeTmK-@)}yUd`4x>p|+I({~VTU zh+S1qRy7Ez$PD#&wJc{(u2YT%rDq5O)+m2iRzHw-6)Z;X={e6Wgg5n9q3Vid-=p_; zdLQX%gh1nL|o7@ zdz;(FAROSmHpaM%S$?7tfue)wf5?}T_oUA}Mksc$xg={sgef6cl4Ms5!@UWQu4_my zYq%g^`b>u~gYP1!3{)$rQWZrw+!RuD5EF00yQZq-=iRza&dul?C7RvAD+Y@W4<+o) zL!9)wl$9JmU8(%`W!Y9?<>h$+5oY!8V%Mb?Xh4blwBs*F#%M@GfxhtN+k6gU19*{gI z43YhNR#WMknCsUn2kbA&A*^G_xl}&gB4$278{3Y2lTL$k$o%sFfZF|@m#^B2-Mk%;T7?UA= z*TZb3PmzhjmsNOa;3gqtUD?@5pBsL*>t-U(YeX&gm2wFe$=iSAa2c=9Ei`yz3QP4I z(59D`kKoGqn%(RYaz{A7%Do)c^L0CyESGC(%3cOORJ0W7Vel5&S{Cy}K5ZurRLE%a zk4b{I=mHlE$3p5k#&WoB|4k_>g-LItOltLR}rP@XAXD z(H1VNey&!!(E(-|5Y{&+w(|r!A2@HeQcFsMr2y1{QG6b0=XFC^jFD@w-SCa+?187A z)7wZZ!Q|j5CSJWw$~1FBp$1iuB>2y>m!Q_+l9X7-^P;+hV+Nl=wXAJMG+XHI1E(>e z;b+9qx$wr6#tPI|U(CY-osm8dlyR*FRl^byNnCzxznBoyK}G((!fB}tp{*ZC2j$09 zK?kiEoEPH}sSIBIbW2{>oR+6+chDdr$yvzDGMaWefkBZ+|qQuBWqJFPL zzO?CcrH5SWr)BI)jyEh(R`Sn{?DrHllP?frcoN+`Xr~g7p!4uFfmPiwij}Jj#Ar!! zQqnB#OZ2(H=N(E~6)*>-!O$66KE_O-?i^k8KsdvWny7+K5}tdiYcYN#VQvnEpc#op#L zzk*6r!0}}=GLHHz<+EZ+&P~T&|HvLIY?a-?Gsu&HIWqI_^-MDZJ(rDuz8y8Ie)^tT zjLi;e(O3C1*-afD=%fEBV`hs}K9rUVoIFM*_Ppym`(rAN^It=jgbqhYwSrCCF9_1- z9NFvHi~kYHmz_vr`Tq@?`G18@zry|6)OoeROvLTUyDp=O9z#dTXA--uW7A@t+I>1U zIZ<;}WAl_xE0#lwt=`NGA?=@lTUZCvcXTX*>&|t=w~@_JKRBepl~S;*RoUYlag${q z8GkW#!O!6ms_MnlpZ%m#VgZ`M>=K;}|Mu=XCoiJyir@nog|XBt^Cz&NnGSqnaUilB zU<`Mf;PdaJ#>E_pF%PYg)-hsgbX+sKml$+(zDs{*zT<2M>o#9E=>m6lUFJQRdxYAg zsdbjkTIoAx1`fHFmg$x!ficwAni(!JQUqmgEaj}VoDl{Bd(Q8&=>_*Q1cmGIv>7SQ zZ|Yf9{nlJ(`1q$EZFssIem!2i>RAM$ZUIDH`?Nm28^ITT&x)M<^^^>4phbgrf*CG1 z*waP-7Zk?#{3g|H^^e1&X5fc43G7j@^w0yxIXhmC@3tnLk zTqPCy{)f9pKjy8YFb~WKP#xu9h3B8O&+JCFL0RKRzmT-Pd>D1rqnCe1(j zMIDF8ro|D|73$3+ihG30em?}skC`o5)WvxNLri1jGZyMt37c&ip8EdA=|}jL-ClW` zQNpl=3%E1x=P5YC`XjLz3p2}Ww|#7KZ-ihABc2MbRtkj)<|wp$DV!9R$gq*KY(^%A zH?a$rRuiPE609rFU8H^*#l%-+TIVhjaOA`LwDegd4(~CbA>uqPmLlbk#ujzF1DH@D za!Xx?TG;K0&1HK^#Fwjg^q=}ya?0(Puic>443@IeJ@O8Zit-4mZ}&e~%Bu#L!gnrC zSr>BU?}$}w-J$5DpWx;=7l{h^fEg1|DOUu{%;`Rji#Mw|lTs z0_JL4y(2xhQ0}YNch^Mx_FP#Wxo02m;#|BIdpRZ29uo%j051>})vz|~-S`U7nAfQF zr#iX8aju$x5>{Wq!glc&*ku_Pg=RjPPMG*zq1h&#mIq2D(!v zZtvFt&M{Q&WMYCrRGlGnZRli@m4gvU%!))kCj7R$cGFLf+DOV7i2s^lb6>uWz;VE+ zTn_hUWB-8ytK2tY)btD-+7%3i3qSIkIZOr|7Duy5j+ym!@wu-Me|ba;NfT=D9f=D51u;BG!df*9|J2BoyY}`WBucp2QF)=b)*Gzb&u!!FW zyh~KXNRn>Y%sUmcHxm`KW^k1MYRbZ&V9=>qzT&o@u_6#9C)WB<16hjrZ5|X^-dPwa~cF53I&RA`>1H$6q?Pn=GE50-i8v{VMhc%B+6e zzc%A6AYN{eprifm`gCFPS%~QP6dN4Ts+lTYmtv#4mEWCd+mmKksDBsc@|EK+2<=;= z8+G~BJ0)jr-^3N^8B*L8TfT-*HWaII#dalK)?``i0G z>C>YD$Z5YTDNCXK3#h+k9WP5tB6eKmQI)+PQ9o9AiV=RgnUg{Iyp7qugwF`gg(<*U zYP{CQj6g9xPFo3ZL2j)8;TC4InaY{}luI$PHWM4gk8Zc=NlSfEU)dOyZ>~gu00>dl zpQC27GE}_Qr_2r+>~+LdcaaJRQAyjanV-e>1Gy-jTF;dshNe#oU_w=iIE|gRS>FmS zR>oXKY`o``AK%ywrs6M+WaLHTZx_G&l9+5D;Fu)PZJu7vY1WcL$_3*L6?r!O-n|JW z2P}R1#RoO?>!%hBZ04`#8NKVbT3IHvRlyvuySEW11{k!NS_9iTQGy$w74YW#Kz z%F6W@PK%5xOtW;Njk=x$3UNuIw8aGwlO*6xobXPsFD#su+GyAwcYQ~~ywUqjhwJrD zGe07NLTYv%9T*)NeD1A2ByM=0c_K=FR+3#6@)A?xI9eXGU|4KCpVpZoTEcr47T&um z!V?L*ak!8kNbOq%gKPjw-z?lM^w?>%+}hbWkUYhualh4xzQcR8)-4M@ct0$wUEiwB}aC{%6$n@1{QM~J!tu)_tibD*;ugY7m14R1)^Al}Q6!pJt zmctZs69Xd}YsvhqMif2ES(0PC<)K+F*LLCOTH;+3zF9?9qfzk_Z)iu` z+hcvbzE&rX5=yU{eHG!FcFDCmp806hEq&@o+*l<6_LOD=S=}aEa$E=%Gdl3%K|SEF zZy->ib`bm0M)(^UO7#vmsM#JbqCT$t`U>slv0EK3N#{)o*=O^O`jHl(F2H$Wdcv)^^4ahF+u>%Vdng27Lw%e1$nYACo#6@O#LN2J22H zW@isiz34bsFbf(k)U69&pZ&#KQc0?e{g+e^8~qPg0c@iF?V2M~{%YHX#KXr$Xrzx^ zKg{a-kf59ynf8ri5DVTt0O}t8`PAHzEDSe|4c^T&=SpQ4Zg196=@m)}JlYDA-2N@d zfAx2YsDQRS-I90Th6?8lV0NXT%kl$bf#Z31N5M`S(bOE;+Okq%)BR=^vMK8p*d?ni`L7aEdi`uZUtAy zYg{ab1+zv&8Mt16Hc>U;>Y{naKn5+_qg~J?NETXXnx_WTD?7akGkJzct|0J7^cxV#HC!Vp4XBia~nrfbjdxc!qDG85}sM-iDy6mVo^icWv z`|wEWBfrVdiC$~Cz!8-H#R0#X>b`13Puy7ejl=%6u_5c#r@imRk5l^Z-wp|w7);3~ zD}1K&RpzfagrK|36&$dUA*4~k4+IKW9z|AE^1WoD&CO)lMV-H}5K*VkRtnM3aQi;m zt2!-$pIh-O%Vj82U#mZo88A+)E3Gj9An(*fL+f6jI_vU6ZG%h(a$`B8&+R;o@81|L z`Ly6zEu3AXDIqhv6$evN7f2auWZ)Rg%H~uuZda2J9{j2|+tuT(lVv7(htlc*r+uy@ z;P?O)W(SG}XBNT*`>V-mdY23!ZxGeGDJzqQW}zs*qGW2F5*hG`B!m4#SC#MBdL} zJ10G<2s;)2@`S*>oY>pQ$j_*&5G_Y=wG&HpFctb^*7B6WM)yPi#!spM{G^;0tl?Ru zu46=9HlY{G1c@>%)~D>^L$ z$d{X;f3oMkyzF)(Lh*Ft-}JK#CC?Xhw9o3c7+LKZd>#kAHks7$Wip`zWdc1u(O>7P z9*w3K9XdUXR`J-=FLIKOxW6zgG~e~nUvG|lC;`RnHBU>?Nnz=h^J`(L%fAvRl(_Ms#LPGGrjy(Luwzg<&dD_&j?HgLdCvck^mP zOQ8EVlw&;Pp9$${)ou+YxtT(TD!tZ>MYrRY&*;w~r)85NPb8Vdwb1C2=a#}>uy(Kq zK89T!426NGC(a1733%@HR6Td8*04?RV#2k01auCtv!aTLN8P?>SLNM=K5Drlkqmbl&~-9shIJaEr)tgQZ)@c#zRL)TFYULuee_Tr{^75voHXnkx2eyzjSxHdV%Tbq zo@<}9+dL0sG>0t-LT;@Y-;fyySpHQBJCD530PRITw5a!5`?hP0lkF)eTi56-;N5cw z&##uNC|mSoG>n99&`9llWszs65Png05@a~A3oU|%W|_wg=4N$;&;CWcXz(Q%-?6j5 zz{yAh_qr?m8ry5|?UMPn%*w6&TJd`A77N%RW?GTQ&roIH(WZkQ7!k@#l(dwb=m^R= zf_K)EiLknAOD;n@!&!xv4-Dr$PINP;b&`Wro6eCd62z8j8K#6Bf3X}S#QTYT%}wO_ zaN8>HEdjd6uf-jDX+ugpgd>hy!ACxGkX{FG{*LB~xg?-E?W379B`4^QuP23B9=>66 z9dKo5G>2bE9RyG?Txc#&CrhcrWMUjT z^PiNkgd*gTG3a&caOn1xJ10|$RzVX%9cc5~xXwL?7LxwZ(ka~Nix zs5=JSC0HKVH_c+h5%EC*XUUY0s&q`3z-*f12NsSq-v#qRhE{#_wnKfp==twtGqGI) z#uku8%pD;dhuST8s*Cv9sl(p2X7ZrkHC;;Tx0e7-5eYv3np>_#!J#B)@J8I&tgAGj zUSGmE&Tw2S$zX@xX$E4vJYA*cA{p5uz`|rA<$PJe7bGAAn%Ahn*Rz3B7f@1@xmgay zs_=2pvVnVu0Vn2CBKaoRg3p7$$tFp^gpADZh6?FrGnxamsK~yF{?9i%b!2BiFT5H~ zbdHJ`wIct!P(yc9^=TYe2oS}9MJL_}{*n1pZEeM+sX`b&JPIrm@ePJ(kGt@(+Bm{$ zUsq;U7U@WtKT(m<(VlA9KY%-xXFafL!_D0tI4ivnE#0k}s97rMds3ZR??s*_U|#eY z((s1|se?%-{h)T!QE`=V!8y*T(TX-n=kfduPw{$;0n+%UYZ1W6)j>w)w0L9`FNPtN+Tq{aoUX*z08 z@~>iB$RnN2ByjK21Ii}qtyTxhX4gJMA%F-cd;L3(4;c?DF%X6ClXvT~-oeY! zNSW|Edg#h}KJ)TH{PhR@)YrwP(l*%GZ@t)>$su`xIJRGOvPCovxwsO|wcaj_^QVsc z*ZlbAI$Qk4akf>X+Gfqdu*7+7&xDnDRK14#cU(I@%08d}Ww73;s{LN&5@prex2Dsv zoomvgV^u3>OAN#_GV29Qs^2BvGinCn%n6)^?4efmWjcH%ijq77@BrH^X|`E5_@Z83 z%v!NsA6L+D6eI7yZls4s;J_+}p-O2czG^IT*f=Zn_U%_17`hs~2Zm9=P^hCwgN}s- z&LZL{MEc?+UK1u0Sc&1!374^kN272aw0X5(U00H*^e7xYd^{gnS+O#M00+uA$ML;U zNc=@nb;a1xc_4SrQf@`@o=M}w(e0OiZoQ3K#uh@sVXuG3^Sya%ScWpF2=#ru9#!%I zgBnc{`f+!pJGK5ST&vPybeweF7io_5<%9zQ%j%Y854z2O2Uc#r;9YZpuo5!i^?PJX z(grPoVmZN~!q#>9Vkc4;Pc> zLR}SiW$W9axP0^CWNd+6CnS&rt6d%EKL0b*I1bxCQuY7yN&NqlnfQM@P5;08=A66L z!diKR+H*(1)~cVcoWYfe4pFxmg+|6aCK@+R`(;v1y!z7;q|mNimGn7rS`3fn2rub%?+*d>xXIPV^Y_(2f!J-+rC+I zFl%cmw1$P(zBg%T38Qy5f3LFi$BDT-U8kbD-ijP#ZgvuS%}WkPPMTO<S)fI;NPHSSAQ(u5hrXtj!yCmVPD(TP@SFajDtb_P)867`}@#;(kmV3Us)>og7iS zH)~$ykhlhXILpH&E+A|LL743TXiuFxn&fawthvlzM9tRhvDZ$UyXUL1cJTWrw%F;I zu3+7Axqrf|tqne&P!S|E9s2m@c}m7-B|b%c50bj<@eQv;JQlT61Z`v1NVymGRptzQ zq%>m!u~Iw)bTvqnC!hs!-LZXPWv#44)Tot$;>x;|Wvy;(>rJQM(F8sh4}AsSNXhHA z%nc2LtpX#7mCjrb)Q@W5ioTV$jQ>(<$aS$^)sOEsWa}2W;Dh;bjCXZ^01a<9+ZtUl z-}wm#>?5nd4Db)CCK32w6J;Fdd~fJpy0VpQ!1qF$=F!a=+G(B7c3X=sBDNFK6k6v) zC3-$@ zz;*+?BLMc`N-bMRprE>q&G$DJNaxq>q~URx`Ea#U%re(q!*LH;Dqfr%KDdY(Q{I%4 zjGt+eH~lhMb+>;PaF;RQMqGFx{l&-cHhYG)|xXJaHB!2t0;`<*H=44gRl zf3D!?(7BHfbeE%5YEzB!YI9)CQgp;?gXhYgo?>8)LXMF;P zYCLct**SrYtld2D*ptM&KRE@zZ58VI{GcV2hTRzmgi64EyQo>kU$n)O>{WoC{K+l& z4cR%wHClxg8)I%YTGsUKu6KPw_Ou}ZsIHabGP07&=-Vi!k7EOuieZiLI`Z!=j~^My zUZ{Mz(ETI;rJWI6<%AmoCOMG7uW$S{7Ws#hB|eX)xBzrk+ZiBkZN7UW$12kNHSZa)P)xx<`S zFZUh%(p*pa1ih9AJ0^tUBb7awBz<=)!HCx(&XLCftEgy4fD5q6 z5*u%-eXM=2TVbOyOf{1vWdFf)Z46r+>N{j)JKDw`=vdH^KTEklvSJ?g_X=!8u7Os9 z{XaHUU^pHswUnHq#U|P7JFY40z4Zl~v9Y zV{HCAI+KLE>CuN=v|JY^U!|D&dP*aWvd|JAK{Z#Zks@M}w0G=nH{6;QFmpwsM(uXZ zT3D8}h6q1voV_8Y)H)`gn?`!y6Pfb~r>y_CM@%@r@lCEDcCswj0o#=7dU~3XRM6K^!@+!5SC9j9 z?H&^lVi2+zRcn!5vZe}*EC>JKA&2Q83`(=E=zO|0=MLmPWqTVjkW+jy{^B^S$B0 zD19=$_X_8<{2_IyTK2946j8EkSr|dFbD4Wb)uSl=J$gM;Hz ze@>7S0gYmdME!uHd?qTj699AeVE(^g&XvEM?vPVj(XW{`;nr z10*2xKSNl|CiJbizq}LYci9X1AJmx;YmO zZg(G#10>_jbcZ|!7>&jy0d(HD*w`fZ;~dT7XTS^}L1j3$09u>$ZsD|8@%)SOEuWK9 zlkcl9^;q+s<&=}Wg8q*LdD!dQkAXLT-uW5z33{~h4?0F%Mv?zGHNrnY)cs`pYtizR zxQJo0c@Yxc2MWq%bESA}$~#0r#5&+;8#M zDS*Fll8HaslF?{IHFHsVb2$ktm+bxHvCw8TU5R2=wh3Sc(qH{aT7T5_ z@a5?-vEHayXhrY7*(-xfbixS?>I&2H-D0zsMQ=AQ>xWXaItbc!d*JTQ?PX-B%@7oP zg#4b=gt6BSPrUe#%362BpgqTrtM~4|$r3EpFzWQtVY1u59g2H|JgufOH(umbw==;g zZ$R*$YEI!Md4U=ADyANNitCdJp^xtFtmOV&U}$B$N6DZfg(*hd^}Hf`dP=W4Ahf~- z6aeVa3ZCXVTpV1)GVYMf&%jGP9$4yWU?%U>pJ^$c+3I#5d&Tb3d(4d&%JR*vF-8V z7y8wwg|L#eLzZEUGn`pe4QD{*@Z!~b?HfZ#txLISkyQM(-z0|y3+;7!f_z{&Nrz{? z5W@4HkvV9ZjbBa6w+2V3F(FJm%FR7)uOKYK%Y{QAcWM_{j1?MUQzOz@_!&Tpty?MZajVVA5t8M=gJ1yraWR>zqme#Fb1S%S z_r=DqkIo%XtWJkT6wUdULnlsaZ0Ya?Y0(~hdf9hF=g|cOo5z5aWZrOPbhRfZ*XT)> zqg{#W`Ut&wrYsGajAp_-Xl^%wC|eF4eoMX8SIWK>x)oj%ZnVhwl2JV}RH>kLB&)Ry zw(!;Ralxa7FE7WB1$!RHXHS=0KqD^c#>chgv|mA5FWQR7=QRS!?uNudKg#oSr(C z?KUMGa<|wgdS_{}uxO$e^@TN6AG#GGdBvIK*kAd!l;OsYBUZ1U@W7{Q5&@Nd$Bo{i zl0z>Md^tq>^x-N#+vDzgEPrM%F#yfOZ6pPcZ#_az?SD|?cT*g88mn}Z4;ZA{0)=uN zrwk2>HABu}K*(SPlvojq5@>Qy{;ngJ}-{=>N#tyz%`E13Ffyxpd5vlnEJyXky ze~~YNGWmkYxXbWbc za`qrDV>HQQ9eY^uazWGEG&3oK%K&4{cxcu49LLbV!UcH3$C0eTVt7A!(-7*glhOV# zHI=I4|A4xxz9TxxbhdEu@{bB0Gqds$mNHbG_CNnVrihJieB^ds@43&V2I*D|?7$|~Xd1O%jVJ>+btH%cMOzMyuDrYog{Y^z&hqc$af&$KE2%()8+4e2})4=%PVt^fGR{85P1tCxb`D12dNn4x0}JGovJSP>nWZAtTtMe3toV7fP)AhlCRTP^`&!)cCRl5e3AQnX~Hl#*N0C}C>T9*;Ix^3pyPUXbPPH7Q^0&dr!;ku3Qf%@q z*^t-KR`ibLg6Q3A)fa>DB;E^7`fxBNRbp*>%L2Drx2-#_RH5*{!zIqcOKHM#4TfSug|M1EZw+##(^7%Q-B z)YR6Bb*kv-=opqhljSuke`|2h0uRwv>!niO$=rH|y{+LR1VCN<@H z&@@LdxdZdAzD*iF^(*0WytzYUIETZKxwlzR7yq5qbHq)8TlBTMkY9B8I z7{1;#p~|=)mlQPf;{u`hu+9u%^Ep2TlXG>i5nK(lSNLVJ8SgY~PGLkV&W6O4JqtR! zLrNr6;A^gH3SYsy=JwKFSugY6ASa&)lVU!2snlO)n6G{Ed02f>!f6!U1pxQ6MBY?d z9f4KSR?4;{Y23_DHIkvy>*Upfani$_b0seLhM(9h$5Av^Q))>8K3V;bpA1~fqt7oFZb&~fsdg;0<~1BUBBz=mdiF}PLvIDA zcis{Ib3j;T1IA0kVsoq6)m+FjMSw{w5F#h-EH(>n6JKO6LLh!K>02?8|aZK@#`}5}tFoTTGPK7q1vR7<{KS)%< zSuW9h-!TPRaH80tlW7a`r(i4Sc?J~(?D-4wM@TYVyLL+`D`D{tQF?dO zTkO_XzQ5$`A9Z#Ma!P8Oe0jCK7F{!00n~L(nj|{J|Fme2SQ8#N$@ppa$u79OraBJd zxA*nMFCyqJkbT<<+gI;r z2=hM_R5>cMi@+S7+(BMpXLClMK$&kn)<_X@Z%M$j6UzLhmoADbIxT3jerT{*c-E69 zY1n8wT6#D<698RT2nXn-BoiVNlg)^fACA#6%;H)dT7zS^3XO z0b*l32?8!P<345|0FS$)tJPAV!BT&%q}p*bxf$OamiP9VHTbrg#W-Mg1ib|A{n3@g z_D=#Oo_53CF(2{uc3U6zT74YL&BNcVCq4z!30tg(dpM@m^gD7xV-JT~_YOf`d7?2H zCEy_`L4RATOiiG!ojfuwODgiToT8-X^M1u~qg|Zu_(C(@xppwp0O{Bkle&Iga=Y1; zXk5i(u$oDQ00g;>3V4;z705Q(cYgdfJ7qF(E4pP!K|yr`D;2Qs>GfgZO;o8MkGjt! zXV&rVAs4SR$C?5I%NGV|QQD1Paz5?G^&=Rr-5vLCS4}cwJ_|Z69{_D*ib#H76-wHIsuXkG zzUg>3g;m_6-JP!MMj+MzW&~g>pCBu;M|PJ1rNe$?THE}*DVP{Hv|z2AqncRhgsV|* zz%V870>=jMU4oM7{OEJL0n%3Le}UQ$?pKZO^S`{nj?ht(+xXS?t?SFc5bIW@bMWJ!mdDzRB1kQ3uN|FT5@!aMpc=$zTP`D&bV zMVVFGSiVlyKii}KyZQ5zfQ2*31r4+C$GR7iEOKCntTEB-b(TT-i&~Crwke`{O|KtW zvL{Wh(4I(STXg=hCG|PiwgnnBD~JkuO%5rVtT@o$3pf2pRPo#CQ(g}kDYZnov8w+E zm0jQ{h@9`l0n22(Py%E7scH3i@zfW#z}B$we5+EG;6`~H;6P+1tS=c>1#G$Oi}c+#L|PGWamRH#@rYW5Qj%)-=Dr9Wv*>!b;4& zS|FmeZNO_*?@8idOgFo?_zNo*M=SDxN%kLl8r%-vO?lB&GwvScI|+8}n5q;QRphRa zZ>c8>b)dc0pn+AD*{PmGM!Ue@945JYS1)%2L&U>@hp-XC_IPBd#KNWEnxM_Q!*QU< z`;Lz$Pfv!A{dy#c+@tINabebGsDY*f&D-L^e3c#GGWI^yi+++lIS+P>dTv~M_##{) zkJ;2U2ymP}!oj_#r5vTHh%j@XX>vF~%twiMF48Xb`o+vB$KBP@&?22;V=TAy?II~B z5nKF`2jhbk%*#LB-iMTILkZXVS$uR~9@ys@r&M%TTG)1#aneXRfX1bj^r<)wG~E_$ zOc7Jl86qd0F5|s<+vo?|pt&7Dvdsdt?hGD0kb#W*Ebdw8xjNEEGOm+Moo0J`;8){> zhfQapSck8 zA$;iGaK7Od5j-Y=Zm$UJC>vv~7%VjCJlUJ2sVUjfwsQLR`pmj-cw_;ip~vC=Li$?W zLYmr^|M4Nw`-}n+nC@Qvn6zH#P8D&RQSd(fev$oY2qojV6?x1?<6(D5gafv)?rR38 z5x{-kEnUEkXpN7?+2!XxI%;C83Zdy?N2-gk8>zzo9L;cUNf#&JR+Gab;`=hP=q*x zip2ag0N#In5&eR22N0PSv*HqqrhuteA+N!XdSl?yHS-Tq4wB8tcAaisr#u0d1jki7 zRq&!}n;VaJO@_Y(tQ6ObSEI*DIQoD=eAvfOrzXD)Uv8}?0R*7gESf~e!DjS-dKx`r zTHyMf{`^kj_sh>yh&}0opw#C+f?f>Ze z9{5)aqsv(2TB@2X7ja_BciKZ zaIIt2k2-r$vn=D%V>EiXbxpP#f5;=5Jo!T-&nzn3(m$;`*ZZeK4{Q-F%5qY zwojw|+reW1;vqdgV6Xl;PC2Q=RYC8P)&?lB$9%O^%WTEGV-fA1;3YEy6nb4E9JQMl zCi?b?r3|MWcsPSy&*N?NDT&bjG6d%gcq#{l&^xYUezsKGkV}2<%fTZ$>f2I8UA%~t zbkKm@ZRBS5V~ z4u^YD&kEIOOD?ofDJ&DT1ws+G2fs-tZ+xJ0x%!!CG}eTW$NK>HJ8Ma(Oo6SU@ZEOt z0~TkT`1Hp8-p!gD(WiCWe{cgm7`w>;BBnTU14~KGh$vdvNd_j)4qw)LdW)asPmf9J z|7PdK3rJ?!6=l26n)l7-Vbdkcv|LHIuqJxn>x0+(lBvvJ-!UwDT6lQJyrH%pRxH1G zS@(N`(k_?}_im5}Uc{RDG`ycZ zr{Alz5zn|d+rD|zU1Tti4mwTdh)Lp}_R+y>Njn&Dqag$bo2zes1cFYUAWY|0k0 zeT9+ZV%Qgw@t-Sh$h-G_!85!ocZn$H=TO1Bu6*VVBcvy9jM!#R-qfY^rL+c1j~mjV z31lO$t)I;G@97`c)5q`$=%-C&q>>Om)dlCLx-;myyrP=gvoM~EAc6}U2v-!ONs)_) z;tjl(!`N6$VCts5HXU3B7|ZH8Bhoost`g)Q8ADNLI$xzo1P zUE=;&n|FYKhci1JmbfP|lKF=DgamP!3!j3w$d*eTzsYIWBGxH=9y=15s4BufG!?3X zYznWgep{$$uBp7As0dD0FU_;O9NnAVprWu~-ZWsft+dDx3D&S*1J;XCgUUvoC?>y|$Sgvi-?{RN zJXkwdcVd@xbl(>Zu4a*q(sX;QRq_`4_C~dM*CJF8bkb-;NjFJU+=v=ZL=2U&m3L2E zMm-c)8ZFMKG6&<+e1c?GP1uLzj0-?!G4GmzPxuH63j?>1cG7K3ozN z;VQDRIToBL*Jd}x8a1WN0*Gn~T6sC|?uX*YU?X{}`@ZW@72b|Y0(NJtg1le)(BYej zx4H*fc*A?RwyZRp{Girkc_1DB>VEO^27g#ZH~R?CTF3nw?3)fc2#2qZZI z@aTOt1Arx?+c_!7MB(9BYS1!(L>5R#>KVVu_>)y>_rNNWCAD!zcZ5z&cl@s=EE%at zHvkhPf{so!*?4Wm4k!VL4+4Z6h2n&bh^DaF4z!QCe*XNC29UOeTxJmyg#W8-EdfYR zkDhLbrxD|^bwHW*!n0ZKm4B+VHnoDW+Q}k2c_(e(e_$N2lJo149th z1pZVjI(f9W?)v=us>zIOPfg4GNn+pD+xpF0(yIV}je_ zVoV&H6Qz34j_fKoL=CR1Xu3Bc)Cv+Vwe68^P2=@%HgGV=UNPw_6^u1sptqmEh?@*b0ZBd<^_UbbIaM%z)akm-))wWpnxK&pVBl{g>{6d`X2nHq?0iOUrMF zU62jXjL>r5Qt~O4ajji5YuG@W($!D$ON{w>Sj)S8~CMsctcdn zYNA2!taM7hAM5F!T;1D`2Oo<)%UZiq+cFmAT@rnzG}I>o*Ld|YUEjUL(2MhLtmW4X zLMad70!FV-<=4i13jw3&P0|cF6)AaVID_7WVLy3*7FPb55in{%gY=_Kv*04a@xV(J zj1gn3%%{#M5}oN!5qsrEO-DfNI)aMyV#n+n?N}BlzJ*+ezGcLQSa%{pe9@n1g_T%C zk3}lKsLiGOfNQ=MbT%B2TU$33%kS#=l$B}0z^SZZ8O@{7n4JaJXrUqhS(W@J`8lUN zESv(&O#NGnv8)mu9UVcdj7z=Z32;B+CcYtx+u}iW|Hx-?7xdl=qct<_FOv(G7dVsh z6%JJ`qiIM9>9?iV^G_#fc43`UC6TC3d!K1Z#`hHSy%(jCEF69?KF}mX$&8Gv3*c87 zx!AlosPgIS2`E>$GP@#DpTE3I8i~F8HwEj800KJZ@#G+n@cnin_Ydp+qRymHQ?m#c zh}lABpU5`yn`fRlE>Q2UOj>RQY0;OR^k6_rR+npm`AJru3fiQ-N0nOD92;leJY1Nl z_|WW_Od3XzGdvD?afk)buE;b&W!dsPc!EbhM=Gjj70ybF1!4z+id;K#!+!lfsl%^I zGzyz$8yP9=7Hfn-h0ZY5uWsX$uMR(sx+SB{=WE)QN!2P0J&6AxkBM?-8fxnA4FYXx&B3VQhzK!)F!s?Xx_LF^X{DSo-*;i0c zOI*A#pBtqbK<7lkWQ3SU)yPToB(NtK^~j&6z1DIsQts}S*OVeE=sV2$pL;re1CRoA z%^8XHYn}Q`0KWbtPrW5qcZMwG%AKX|Ea-mcW33q85c1*5YW(y8-PasQNUI6DT;B*u zW`FO3M`aD9V!*opH zTkNCz(<9?#-;1Mim26x45P`3?@2J=7N*I%1p&g;XygDGkhayiAg8kW&HURe6ewF1* zt0rI(9SJ%hVSDLtcV#hjq=yEl3LxGN+?TrO#xpiA%kaaR#oHb_7S%8i2mt^(ZTrKN zDT4?;ciO1;%czp=!w^%#P3gQh3*|+a?O5&NA4*n$X+0pZWj~fiUd+0p1r%Iz^b$W{ zH3%mSr$~{|VVr3Fm33N^a_7+HG^@(fAJC%{q!HY!W z7na)e_fdMfBIMHaes4$u>~Kq~0)e@_{(FjAK~S}cj~kkDpa}Z4S!oT5yA#PvVkvS& z#^pe?(^0ffvP~uIaw4n(eE*Y%jqh~|rt@talkojx5Cag7eos7i?+8Fa&nk!U?U}cV zZH@2m)LkWcIh27L&$HB`35R7>jJu|7k7i-YFEwN?8ZcAbfmZpB^ z@Ny|YQ9I@vP)Fv};9V2=9~l+dlt(uJKSiZu{y(7=@X`N+w9Dc3O(V}*-pu?QV~(8g NjM;@#<)*Ij{{YAe+n)dc literal 0 HcmV?d00001 diff --git a/docs/documentation/server_development/topics/identity-brokering.adoc b/docs/documentation/server_development/topics/identity-brokering.adoc index cf5ca925192..cce77497105 100644 --- a/docs/documentation/server_development/topics/identity-brokering.adoc +++ b/docs/documentation/server_development/topics/identity-brokering.adoc @@ -1,4 +1,5 @@ +[[_identity-brokering-apis]] == Identity Brokering APIs {project_name} can delegate authentication to a parent IDP for login. A typical example of this is the case diff --git a/docs/documentation/server_development/topics/identity-brokering/tokens.adoc b/docs/documentation/server_development/topics/identity-brokering/tokens.adoc index 40c02c6154d..69231487b74 100644 --- a/docs/documentation/server_development/topics/identity-brokering/tokens.adoc +++ b/docs/documentation/server_development/topics/identity-brokering/tokens.adoc @@ -1,8 +1,13 @@ === Retrieving external IDP tokens -{project_name} allows you to store tokens and responses from the authentication process with the external IDP. -For that, you can use the `Store Token` configuration option on the IDP's settings page. +{project_name} allows you to store tokens and responses from the authentication process with the external IDP. There are two versions of this feature that are slightly different in their behavior. + +==== Identity brokering API V1 + +Version 1 or V1 is the old feature and enabled by default. In a future {project_name} release V1 will be deprecated and substituted by V2. + +You can use the `Store Tokens` configuration option in the `Advanced settings` section of the IDP's settings page. Once this option is enabled, when a user authenticates using a external Identity provider, the returned token will be stored inside the database for each user and IDP. Application code can retrieve these tokens and responses to pull in extra user information, or to securely invoke requests on the external IDP. For example, an application might want to use the Google token to invoke on other Google services and REST APIs. @@ -23,4 +28,44 @@ In the broker configuration page you can automatically assign this role to newly These external tokens can be re-established by either logging in again through the provider, or using the client initiated account linking API. +==== Identity brokering API V2 +:tech_feature_name: Identity Brokering API V2 +:tech_feature_id: identity-brokering-api:v2 +include::../templates/techpreview.adoc[] + +Version 2 or V2 is the new feature that is now in preview status. The new feature manages two different configuration options in the same Identity Provider page. + +* **Store token in session**: New option that stores the returned token in the user session associated to the login. +* **Store tokens**: Same option used in V1 and with the same meaning. The store token returned by the external provider is stored in the database after a successful login. + +.Configuration options for store tokens at Identity Provider +image::images/retrieve-external-token-identity-provider.png[Configuration options for store tokens at Identity Provider] + +The application continues accessing the same endpoint inside the REST API to retrieve the brokering token, but in V2 the call uses `POST` and requires client authentication. It is then restricted to confidential clients only. Besides, instead of using the `read-token` role for the user, the client should be enabled to retrieve tokens for the specified IDP alias. In the client configuration, **Settings**, section **Capability config**, there are two new configuration options. + +* **Allow retrieve external tokens**: Flag that allows the client to retrieve tokens via the brokering API. +* **Allowed Identity Providers for External Tokens**: List of identity provider aliases from which the client can retrieve external tokens. + +.Configuration options to retrieve external tokens in the client +image::images/retrieve-external-token-client.png[Configuration options to retrieve external tokens in the client] + +This behavior is more aligned with other features and supported OAuth grants. The access token is passed using the `token` parameter. + +[source,subs="attributes+"] +---- +POST {kc_realms_path}/{realm-name}/broker/{provider_alias}/token HTTP/1.1 +Host: localhost:8080 +Content-Type: application/x-www-form-urlencoded +Accept: application/json + +client_id=test-client& +client_secret=XXXXX& +token=ey... +---- + +The endpoint tries to obtain the external token from the user session associated to the access token. The database is only used as a fallback in case the token is not present or expired in the session. + +The response in V2 is always a JSON access token response, in which the parameter `access_token` is present for a successful request, and parameter `error` is added in case of a problem. Version V2 follows OAuth 2.0 specification in this regard. + +V2 also applies client policies when calling the external token endpoint. This way, administrators can configure them to enforce extra security to the client and the Identity provider involved in the call. diff --git a/docs/guides/securing-apps/token-exchange.adoc b/docs/guides/securing-apps/token-exchange.adoc index c6a86624507..4fa6c1cc67b 100644 --- a/docs/guides/securing-apps/token-exchange.adoc +++ b/docs/guides/securing-apps/token-exchange.adoc @@ -326,7 +326,7 @@ s|Authorization | Verification that the requester client must be in the audienc s|Revocation chain | Not available for access tokens. Available for refresh tokens | Not available for access nor refresh tokens s|Delegation per RFC 8693|Not supported yet|Not supported s|Resource parameter per RFC 8693|Not supported yet|Not supported -s|Internal to external Token Exchange | Not implemented yet | Implemented as a preview +s|Internal to external Token Exchange | Identity brokering APIs can be used instead. See link:{developerguide_link}#_identity-brokering-apis[Identity Brokering APIs] for more information. | Implemented as a preview s|External to internal Token Exchange | Use-case implemented by Standard Token Exchange V2 and JWT Authorization Grant. See <@links.securingapps id="oauth-identity-authorization-chaining-across-domains" /> for more information. | Implemented as a preview s|Subject impersonation (including direct naked impersonation) | Not implemented yet | Implemented as a preview |=== @@ -552,6 +552,8 @@ the client making the request to successfully complete the exchange. === Internal token to external token exchange +NOTE: For internal token to external token exchange, it is recommended to use link:{developerguide_link}#_identity-brokering-apis[Identity Brokering APIs] instead. The legacy Token Exchange V1 is deprecated and will be removed in future versions. + You can exchange a realm token for an external token minted by an external identity provider. This external identity provider must be configured within the `Identity Provider` section of the Admin Console. Currently only OAuth/OpenID Connect based external identity providers are supported, this includes all social providers. {project_name} does not perform a backchannel exchange to the external provider. So if the account