Skip to content

Commit 403588a

Browse files
mposoldamposolda
committed
Deploying to main from @ 98e697377d4f524953b6b1141f0c695b12b8f0c4 🚀
1 parent ef504ab commit 403588a

File tree

8 files changed

+298
-24
lines changed

8 files changed

+298
-24
lines changed

‎2025/05/standard-token-exchange-kc-26-2.html

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
2+
<!doctype html>
3+
<html lang="en" prefix="og: https://ogp.me/ns#">
4+
<head>
5+
<script async src="https://www.googletagmanager.com/gtag/js?id=G-0J2P9316N6"></script>
6+
<script>
7+
window.dataLayer = window.dataLayer || [];
8+
function gtag(){dataLayer.push(arguments);}
9+
gtag('js', new Date());
10+
gtag('config', 'G-0J2P9316N6');
11+
</script>
12+
<meta charset="utf-8"/>
13+
<title>Standard Token Exchange is now officially supported in Keycloak 26.2 - Keycloak</title>
14+
<meta name="twitter:card" content="summary_large">
15+
<meta name="twitter:site" content="@keycloak">
16+
<meta property="og:site_name" content="Keycloak">
17+
<meta property="og:title" content="Standard Token Exchange is now officially supported in Keycloak 26.2">
18+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
19+
<meta name="description" property="og:description" content="Keycloak 26.2 brings Token Exchange out of preview with an officially supported version compliant with OAuth 2.0 Token Exchange specification.">
20+
<meta name="author" content="Giuseppe Graziano">
21+
<meta name="keywords" content="sso,idm,openid connect,saml,kerberos,ldap">
22+
<link href="https://www.keycloak.org/resources/bootstrap/dist/css/bootstrap.min.css" rel="stylesheet">
23+
<link href="https://www.keycloak.org/resources/@fortawesome/fontawesome-free/css/all.min.css" rel="stylesheet">
24+
<link href="https://www.keycloak.org/resources/css/keycloak.css" rel="stylesheet">
25+
<link rel="canonical" href="https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2">
26+
<meta property="og:url" content="https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2">
27+
<link rel="shortcut icon" href="https://www.keycloak.org/resources/favicon.ico">
28+
<script src="https://www.keycloak.org/resources/bootstrap/dist/js/bootstrap.min.js" type="text/javascript"></script>
29+
<script src="https://www.keycloak.org/resources/tocbot/dist/tocbot.min.js" type="text/javascript"></script>
30+
<link rel="alternate" type="application/rss+xml" title="Keycloak's Blog" href="https://www.keycloak.org/rss.xml">
31+
<script type="application/ld+json">
32+
{"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2","headline":"Standard Token Exchange is now officially supported in Keycloak 26.2","name":"Standard Token Exchange is now officially supported in Keycloak 26.2","datePublished":"2025-05-26T08:00:00Z","inLanguage":"en","abstract":"Keycloak 26.2 brings Token Exchange out of preview with an officially supported version compliant with OAuth 2.0 Token Exchange specification.","url":"https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2","publisher":{"@type":"Organization","@id":"https://keycloak.org","name":"Keycloak"},"author":[{"@type":"Person","name":"Giuseppe Graziano"}]}
33+
</script></head>
34+
<body>
35+
36+
<header class="navbar navbar-expand-md bg-light shadow-sm">
37+
<nav class="container-xxl flex-wrap flex-md-no-wrap navbar-light" data-nosnippet>
38+
<a class="navbar-brand me-3 me-md-4 me-lg-5" href="https://www.keycloak.org/">
39+
<img class="img-fluid" src="https://www.keycloak.org/resources/images/logo.svg" width="240" alt="Keycloak"/>
40+
</a>
41+
<a class="nav-link d-none d-sm-block d-md-none d-lg-block" href="https://github.com/keycloak/keycloak"><img src="https://img.shields.io/github/stars/keycloak/keycloak?label=GitHub%20Stars" style="height: 25px" alt="GitHub stars"/></a>
42+
<a class="nav-link d-block d-sm-none d-md-block d-lg-none" href="https://github.com/keycloak/keycloak"><img src="https://img.shields.io/github/stars/keycloak/keycloak?label=" style="height: 25px" alt="GitHub stars"/></a>
43+
<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarCollapse" aria-controls="navbarCollapse" aria-expanded="false" aria-label="Toggle navigation">
44+
<span class="fa fa-bars fa-lg px-1 py-2"></span>
45+
</button>
46+
<div class="collapse navbar-collapse" id="navbarCollapse">
47+
<ul class="navbar-nav flex-row flex-wrap bd-navbar-nav pt-2 py-md-0">
48+
<li class="nav-item col-6 col-md-auto">
49+
<a class="nav-link " href="https://www.keycloak.org/guides">Guides</a>
50+
</li>
51+
<li class="nav-item col-6 col-md-auto">
52+
<a class="nav-link " href="https://www.keycloak.org/documentation">Docs</a>
53+
</li>
54+
<li class="nav-item col-6 col-md-auto">
55+
<a class="nav-link " href="https://www.keycloak.org/downloads">Downloads</a>
56+
</li>
57+
<li class="nav-item col-6 col-md-auto">
58+
<a class="nav-link " href="https://www.keycloak.org/community">Community</a>
59+
</li>
60+
<li class="nav-item col-6 col-md-auto">
61+
<a class="nav-link " href="https://www.keycloak.org/blog">Blog</a>
62+
</li>
63+
</ul>
64+
</div>
65+
</nav>
66+
</header>
67+
68+
69+
<div class="container mt-5 kc-article">
70+
<h1>Standard Token Exchange is now officially supported in Keycloak 26.2</h1>
71+
<p class="blog-date text-muted">May 26 2025 by Giuseppe Graziano</p>
72+
73+
74+
<div class="paragraph">
75+
<p>The Token Exchange feature has been available in Keycloak for a long time, but only as a preview feature. With the release of
76+
<strong>Keycloak 26.2</strong>, we&#8217;re happy to share that <strong>Standard Token Exchange is now officially supported</strong> and fully compliant with <a href="https://datatracker.ietf.org/doc/html/rfc8693">OAuth 2.0 Token Exchange (RFC 8693)</a>.</p>
77+
</div>
78+
<div class="sect1">
79+
<h2 id="_what_is_token_exchange">What is Token Exchange? 🔄</h2>
80+
<div class="sectionbody">
81+
<div class="paragraph">
82+
<p>Token Exchange is a mechanism that allows a client to exchange one token for another. In the context of Keycloak, this means a client can exchange a token originally issued for another client and receive a new token issued specifically for itself.</p>
83+
</div>
84+
<div class="paragraph">
85+
<p>Token Exchange is especially helpful in these scenarios:</p>
86+
</div>
87+
<div class="sect2">
88+
<h3 id="_different_audience">🎯 Different Audience</h3>
89+
<div class="paragraph">
90+
<p>When a token was issued for one service but needs to be used to access another, Token Exchange can issue a new token with the appropriate audience.</p>
91+
</div>
92+
</div>
93+
<div class="sect2">
94+
<h3 id="_scoped_permissions">🔐 Scoped Permissions</h3>
95+
<div class="paragraph">
96+
<p>If a client needs to access a service with more limited permissions, it can exchange its token for one with reduced or more specific scopes.</p>
97+
</div>
98+
</div>
99+
</div>
100+
</div>
101+
<div class="sect1">
102+
<h2 id="_whats_new">What&#8217;s new? 🆕</h2>
103+
<div class="sectionbody">
104+
<div class="ulist">
105+
<ul>
106+
<li>
107+
<p>✅ Official support (no longer a preview feature)</p>
108+
</li>
109+
<li>
110+
<p>📘 Compliance with RFC 8693 (OAuth 2.0 Token Exchange)</p>
111+
</li>
112+
<li>
113+
<p>🖱️ Simple configuration via the Admin Console (just a switch in client settings)</p>
114+
</li>
115+
<li>
116+
<p>🛡️ Integration with Client Policies to enforce custom rules. You can restrict exchanges to specific clients, or deny exchanges based on requested scopes.</p>
117+
</li>
118+
</ul>
119+
</div>
120+
</div>
121+
</div>
122+
<div class="sect1">
123+
<h2 id="_how_to_get_started">How to get started 🚀</h2>
124+
<div class="sectionbody">
125+
<div class="paragraph">
126+
<p>If you&#8217;re using Keycloak 26.2 or later, there&#8217;s nothing extra to enable. Token Exchange is ready to use, just open the client settings in the admin console and enable the dedicated switch.</p>
127+
</div>
128+
<div class="paragraph">
129+
<p>If you&#8217;re still using the preview feature of token exchange, check the <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#supported-standard-token-exchange">migration guide</a> and the <a href="https://www.keycloak.org/securing-apps/token-exchange#_standard-token-exchange-comparison">comparison</a> to understand the differences and plan your migration.</p>
130+
</div>
131+
<div class="paragraph">
132+
<p>📄 For full setup instructions and configuration details, refer to the <a href="https://www.keycloak.org/securing-apps/token-exchange#_standard-token-exchange">official documentation</a>.</p>
133+
</div>
134+
</div>
135+
</div>
136+
<div class="sect1">
137+
<h2 id="_whats_next">What’s next? 🔍</h2>
138+
<div class="sectionbody">
139+
<div class="paragraph">
140+
<p>We’re continuing to expand Token Exchange support with future enhancements such as:</p>
141+
</div>
142+
<div class="ulist">
143+
<ul>
144+
<li>
145+
<p>🔄 Exchanging tokens issued by external identity providers</p>
146+
</li>
147+
<li>
148+
<p>👤 Using token exchange to impersonate users</p>
149+
</li>
150+
</ul>
151+
</div>
152+
<div class="paragraph">
153+
<p>Stay tuned for updates in upcoming releases.</p>
154+
</div>
155+
<hr>
156+
<div class="paragraph">
157+
<p>We’d love to hear what you think about this feature and how we can improve it. Feedback and contributions from the community are always welcome.</p>
158+
</div>
159+
</div>
160+
</div></div>
161+
162+
163+
<div class="container mt-5" data-nosnippet>
164+
<footer class="py-3 my-4 border-top">
165+
<p class="text-center text-muted">Keycloak is a Cloud Native Computing Foundation incubation project</p>
166+
<div class="text-center">
167+
<img alt="Cloud Native Computing Foundation" src="https://www.keycloak.org/resources/images/cncf_logo.png"/>
168+
</div>
169+
<p class="mt-4 text-center small text-muted">&copy; Keycloak Authors 2025. &copy; 2025 The Linux Foundation. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our <a href="https://www.linuxfoundation.org/trademark-usage">Trademark Usage page</a>.</p>
170+
</footer>
171+
</div>
172+
173+
</body>
174+
</html>

‎blog-archive.html

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,11 @@ <h2>2025</h2>
8484

8585
<h3>May</h3>
8686

87+
<ul>
88+
<li><a href="https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2">Standard Token Exchange is now officially supported in Keycloak 26.2</a></li>
89+
</ul>
90+
91+
8792
<ul>
8893
<li><a href="https://www.keycloak.org/2025/05/hitachi-case-study">Hitachi Keycloak case study published</a></li>
8994
</ul>

‎blog.html

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,23 @@
6666
<div class="jumbotron jumbotron-fluid bg-light kc-bg-triangles pt-4 pb-2">
6767
<div class="container">
6868
<div class="row">
69+
<div class="col-sm-6">
70+
<div class="card shadow-sm mb-4">
71+
<div class="card-body">
72+
<h4 class="card-title" >
73+
Standard Token Exchange is now officially supported in Keycloak 26.2
74+
</h4>
75+
<div class="card-text">Keycloak 26.2 brings Token Exchange out of preview with an officially supported version compliant with OAuth 2.0 Token Exchange specification.</div>
76+
<a href="https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2" class="stretched-link link-dark"></a>
77+
</div>
78+
<div class="card-footer align-items-center d-flex">
79+
<span class="card-subtitle fs-xsmall text-muted">
80+
26 May 2025
81+
by Giuseppe Graziano
82+
</span>
83+
</div>
84+
</div>
85+
</div>
6986
<div class="col-sm-6">
7087
<div class="card shadow-sm mb-4">
7188
<div class="card-body">
@@ -182,23 +199,6 @@ <h4 class="card-title" style="margin-bottom:0">
182199
</div>
183200
</div>
184201
</div>
185-
<div class="col-sm-6">
186-
<div class="card shadow-sm mb-4">
187-
<div class="card-body">
188-
<h4 class="card-title" >
189-
Announcing Keycloak's Identity Summit: KEYCONF25
190-
</h4>
191-
<div class="card-text">Join us in Amsterdam on August 28th, 2025 for an even bigger event than last year!</div>
192-
<a href="https://www.keycloak.org/2025/04/keyconf25-amsterdam-announce" class="stretched-link link-dark"></a>
193-
</div>
194-
<div class="card-footer align-items-center d-flex">
195-
<span class="card-subtitle fs-xsmall text-muted">
196-
28 April 2025
197-
by Nathalia Pinesi
198-
</span>
199-
</div>
200-
</div>
201-
</div>
202202
</div>
203203
<div class="row">
204204
<div class="col">

‎extensions.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ <h5 class="card-title">BundID Integration</h5>
137137
<div class="d-flex align-items-center">
138138
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
139139
class="me-2"/>
140-
<span>15 stars</span>
140+
<span>16 stars</span>
141141
</div>
142142
</div>
143143
</div>
@@ -419,7 +419,7 @@ <h5 class="card-title">Magic Link Login</h5>
419419
<div class="d-flex align-items-center">
420420
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
421421
class="me-2"/>
422-
<span>293 stars</span>
422+
<span>294 stars</span>
423423
</div>
424424
</div>
425425
</div>

‎index.html

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,13 +96,13 @@ <h1 class="fs-xlarge">Open Source Identity and Access Management</h1>
9696
<div class="row">
9797
<div class="col-md-1 col-sm-12 fw-bold">News</div>
9898
<div class="col">
99-
<span class="badge bg-secondary">19 May</span> <a href="https://www.keycloak.org/2025/05/hitachi-case-study">Hitachi Keycloak case study published</a>
99+
<span class="badge bg-secondary">26 May</span> <a href="https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2">Standard Token Exchange is now officially supported in Keycloak 26.2</a>
100100
</div>
101101
<div class="col">
102-
<span class="badge bg-secondary">18 May</span> <a href="https://www.keycloak.org/2025/05/send-mails-xoauth-26-2">Secure email delivery with XOAUTH2</a>
102+
<span class="badge bg-secondary">19 May</span> <a href="https://www.keycloak.org/2025/05/hitachi-case-study">Hitachi Keycloak case study published</a>
103103
</div>
104104
<div class="col">
105-
<span class="badge bg-secondary">15 May</span> <a href="https://www.keycloak.org/2025/05/opentalk-case-study">OpenTalk Keycloak case study published</a>
105+
<span class="badge bg-secondary">18 May</span> <a href="https://www.keycloak.org/2025/05/send-mails-xoauth-26-2">Secure email delivery with XOAUTH2</a>
106106
</div>
107107
</div>
108108
</div>

‎rss.xml

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,101 @@
88
<description>Keycloak Blog</description>
99
<language>en-us</language>
1010
<category>Keycloak/SSO/Identity and Access Management</category>
11+
<item>
12+
<title>Standard Token Exchange is now officially supported in Keycloak 26.2</title>
13+
<link>https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2</link>
14+
<description>&lt;div class=&quot;paragraph&quot;&gt;
15+
&lt;p&gt;The Token Exchange feature has been available in Keycloak for a long time, but only as a preview feature. With the release of
16+
&lt;strong&gt;Keycloak 26.2&lt;/strong&gt;, we&amp;#8217;re happy to share that &lt;strong&gt;Standard Token Exchange is now officially supported&lt;/strong&gt; and fully compliant with &lt;a href=&quot;https://datatracker.ietf.org/doc/html/rfc8693&quot;&gt;OAuth 2.0 Token Exchange (RFC 8693)&lt;/a&gt;.&lt;/p&gt;
17+
&lt;/div&gt;
18+
&lt;div class=&quot;sect1&quot;&gt;
19+
&lt;h2 id=&quot;_what_is_token_exchange&quot;&gt;What is Token Exchange? 🔄&lt;/h2&gt;
20+
&lt;div class=&quot;sectionbody&quot;&gt;
21+
&lt;div class=&quot;paragraph&quot;&gt;
22+
&lt;p&gt;Token Exchange is a mechanism that allows a client to exchange one token for another. In the context of Keycloak, this means a client can exchange a token originally issued for another client and receive a new token issued specifically for itself.&lt;/p&gt;
23+
&lt;/div&gt;
24+
&lt;div class=&quot;paragraph&quot;&gt;
25+
&lt;p&gt;Token Exchange is especially helpful in these scenarios:&lt;/p&gt;
26+
&lt;/div&gt;
27+
&lt;div class=&quot;sect2&quot;&gt;
28+
&lt;h3 id=&quot;_different_audience&quot;&gt;🎯 Different Audience&lt;/h3&gt;
29+
&lt;div class=&quot;paragraph&quot;&gt;
30+
&lt;p&gt;When a token was issued for one service but needs to be used to access another, Token Exchange can issue a new token with the appropriate audience.&lt;/p&gt;
31+
&lt;/div&gt;
32+
&lt;/div&gt;
33+
&lt;div class=&quot;sect2&quot;&gt;
34+
&lt;h3 id=&quot;_scoped_permissions&quot;&gt;🔐 Scoped Permissions&lt;/h3&gt;
35+
&lt;div class=&quot;paragraph&quot;&gt;
36+
&lt;p&gt;If a client needs to access a service with more limited permissions, it can exchange its token for one with reduced or more specific scopes.&lt;/p&gt;
37+
&lt;/div&gt;
38+
&lt;/div&gt;
39+
&lt;/div&gt;
40+
&lt;/div&gt;
41+
&lt;div class=&quot;sect1&quot;&gt;
42+
&lt;h2 id=&quot;_whats_new&quot;&gt;What&amp;#8217;s new? 🆕&lt;/h2&gt;
43+
&lt;div class=&quot;sectionbody&quot;&gt;
44+
&lt;div class=&quot;ulist&quot;&gt;
45+
&lt;ul&gt;
46+
&lt;li&gt;
47+
&lt;p&gt;✅ Official support (no longer a preview feature)&lt;/p&gt;
48+
&lt;/li&gt;
49+
&lt;li&gt;
50+
&lt;p&gt;📘 Compliance with RFC 8693 (OAuth 2.0 Token Exchange)&lt;/p&gt;
51+
&lt;/li&gt;
52+
&lt;li&gt;
53+
&lt;p&gt;🖱️ Simple configuration via the Admin Console (just a switch in client settings)&lt;/p&gt;
54+
&lt;/li&gt;
55+
&lt;li&gt;
56+
&lt;p&gt;🛡️ Integration with Client Policies to enforce custom rules. You can restrict exchanges to specific clients, or deny exchanges based on requested scopes.&lt;/p&gt;
57+
&lt;/li&gt;
58+
&lt;/ul&gt;
59+
&lt;/div&gt;
60+
&lt;/div&gt;
61+
&lt;/div&gt;
62+
&lt;div class=&quot;sect1&quot;&gt;
63+
&lt;h2 id=&quot;_how_to_get_started&quot;&gt;How to get started 🚀&lt;/h2&gt;
64+
&lt;div class=&quot;sectionbody&quot;&gt;
65+
&lt;div class=&quot;paragraph&quot;&gt;
66+
&lt;p&gt;If you&amp;#8217;re using Keycloak 26.2 or later, there&amp;#8217;s nothing extra to enable. Token Exchange is ready to use, just open the client settings in the admin console and enable the dedicated switch.&lt;/p&gt;
67+
&lt;/div&gt;
68+
&lt;div class=&quot;paragraph&quot;&gt;
69+
&lt;p&gt;If you&amp;#8217;re still using the preview feature of token exchange, check the &lt;a href=&quot;https://www.keycloak.org/docs/latest/upgrading/index.html#supported-standard-token-exchange&quot;&gt;migration guide&lt;/a&gt; and the &lt;a href=&quot;https://www.keycloak.org/securing-apps/token-exchange#_standard-token-exchange-comparison&quot;&gt;comparison&lt;/a&gt; to understand the differences and plan your migration.&lt;/p&gt;
70+
&lt;/div&gt;
71+
&lt;div class=&quot;paragraph&quot;&gt;
72+
&lt;p&gt;📄 For full setup instructions and configuration details, refer to the &lt;a href=&quot;https://www.keycloak.org/securing-apps/token-exchange#_standard-token-exchange&quot;&gt;official documentation&lt;/a&gt;.&lt;/p&gt;
73+
&lt;/div&gt;
74+
&lt;/div&gt;
75+
&lt;/div&gt;
76+
&lt;div class=&quot;sect1&quot;&gt;
77+
&lt;h2 id=&quot;_whats_next&quot;&gt;What’s next? 🔍&lt;/h2&gt;
78+
&lt;div class=&quot;sectionbody&quot;&gt;
79+
&lt;div class=&quot;paragraph&quot;&gt;
80+
&lt;p&gt;We’re continuing to expand Token Exchange support with future enhancements such as:&lt;/p&gt;
81+
&lt;/div&gt;
82+
&lt;div class=&quot;ulist&quot;&gt;
83+
&lt;ul&gt;
84+
&lt;li&gt;
85+
&lt;p&gt;🔄 Exchanging tokens issued by external identity providers&lt;/p&gt;
86+
&lt;/li&gt;
87+
&lt;li&gt;
88+
&lt;p&gt;👤 Using token exchange to impersonate users&lt;/p&gt;
89+
&lt;/li&gt;
90+
&lt;/ul&gt;
91+
&lt;/div&gt;
92+
&lt;div class=&quot;paragraph&quot;&gt;
93+
&lt;p&gt;Stay tuned for updates in upcoming releases.&lt;/p&gt;
94+
&lt;/div&gt;
95+
&lt;hr&gt;
96+
&lt;div class=&quot;paragraph&quot;&gt;
97+
&lt;p&gt;We’d love to hear what you think about this feature and how we can improve it. Feedback and contributions from the community are always welcome.&lt;/p&gt;
98+
&lt;/div&gt;
99+
&lt;/div&gt;
100+
&lt;/div&gt;</description>
101+
<guid>https://www.keycloak.org/2025/05/standard-token-exchange-kc-26-2</guid>
102+
<pubDate>Mon, 26 May 2025 00:00:00 GMT</pubDate>
103+
104+
<author>Giuseppe Graziano</author>
105+
</item>
11106
<item>
12107
<title>Hitachi Keycloak case study published</title>
13108
<link>https://www.keycloak.org/2025/05/hitachi-case-study</link>

0 commit comments

Comments
 (0)