Keycloak Token Exchange, Hands-On
How standard token exchange (RFC 8693) works in Keycloak 26, why the audience is everything, and a Docker lab that shows the main success and failure cases on the wire.
Identity engineering beyond the happy path
Practical guides to Keycloak, OAuth 2.0, OpenID Connect and identity federation: how the protocols behave on the wire, which settings matter, and what breaks in production. Most posts come with a lab you can run, so you can decode the tokens yourself.
Hi, I’m Filip, an IAM engineer in Vienna with 15+ years in software. Today I work on Keycloak at a large European retailer: OIDC and SAML clients, Entra ID brokering, and highly available clusters on Kubernetes in the cloud.
filip.jwteyJhbGciOiJSUzI1NiIsImtpZCI6ImlhbWZpbGlwIiwidHlwIjoiSldUIn0.eyJhdWQiOiJ5b3UiLCJpc3MiOiJodHRwczovL2lhbWZpbGlwLmRldi8iLCJuYW1lIjoiRmlsaXAiLCJyb2xlIjoiSUFNIEVuZ2luZWVyIiwic2NvcGUiOiJrZXljbG9hayBvaWRjIHNhbWwgZW50cmEtaWQgazhzIiwic3ViIjoiZmlsaXAifQ.c2lnbmVkLWJ5LWNvZmZlZQ
Payload
{
"aud": "you",
"iss": "https://iamfilip.dev/",
"name": "Filip",
"role": "IAM Engineer",
"scope": "keycloak oidc saml entra-id k8s",
"sub": "filip"
}Start here
More posts
All postsKeycloak Is Not Your Zero Trust Architecture
Where Keycloak's job ends and your APIs' job begins: two Go APIs, eleven requests that should succeed or fail, and the results from a real run.