Support for Token Exchange Flow in Access Token Management Library

[TomSteer]

Hello,

We're currently using the Access Token Management library to manage access tokens for machine-to-machine (M2M) APIs. Another scenario we need to support is the "on behalf of" token exchange, and we would like to utilize the same library for managing the exchanged tokens.

I was wondering if this is something that could potentially be supported in a similar manner to the current client credentials token management implementation?

Thanks, Tom

[brockallen]

Another scenario we need to support is the "on behalf of" token exchange

You mean via some sort of token exchange at the authorization server?

[TomSteer]

Yes, our authorization server supports token exchange. We would like to utilize the token management features, such as caching, in the Access Token Management library when using the token exchange flow.

[TomSteer]

Looks like they have support for it in MSAL.NET:
https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/web-apps-apis/on-behalf-of-flow

[RolandGuijt]

Implementing token exchange in Access Token Management is possible today using the extensibility points available. We never implemented specific scenarios because we figured that every one is different.
However we do think it's a good idea to support this in the future. I've added this to our internal ideas list and I invite everyone who needs this to upvote this idea.
Thanks for the suggestion!

[TomSteer]

Thanks for the update, @RolandGuijt! That’s great news that this is being considered as a first-party feature for the future.

In the meantime, I looked through the link you provided but couldn’t quite see how this could be supported now using the extensibility points. I came across the ImpersonationAccessTokenRetriever logic in the BFF project, but I wasn’t sure how it interfaces with the Access Token Management library. Is this functionality hidden away inside the Duende.Bff.Yarp project?

[RolandGuijt]

Sorry for the confusion. I shared the link to the BFF project because at the moment that's a good example on how token exchange could be used, but the solution is not BFF specific.
Please focus on the ImpersonationAccessTokenRetriever on the client side and TokenExchangeGrantValidator on IdentityServer's side.
Further context can be found here.