# Enabling account linking with External Token Exchange

**URL:** <https://forum.keycloak.org/t/enabling-account-linking-with-external-token-exchange/2183>\
**Category:** Getting advice\
**Created:** [April 16, 2020, 10:08am UTC](https://forum.keycloak.org/t/enabling-account-linking-with-external-token-exchange/2183 "2020-04-16T10:08:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![edL](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@edL](https://forum.keycloak.org/u/edL)\
**Post date:** [April 16, 2020, 10:08am UTC](https://forum.keycloak.org/t/enabling-account-linking-with-external-token-exchange/2183/1 "2020-04-16T10:08:04Z")

</div>

Hi, I’m investigating using the token exchange mechanism to provide in-game SSO for a cross-platform title. The player can sign in with eg Xbox live on their console, which gives us a token that we can exchange.

The slight complication is that we have been using KeyCloak for a few years for our website and forums and already have many thousands of registered users, so the following notice in the docs is very concerning:

> The current limitation on external token exchanges is that if the external token maps to an existing user an exchange will not be allowed unless the existing user already has an account link to the external identity provider.

I need to know if/how this limitation can be lifted, otherwise we’re likely to see a lot of failed sign-in attempts from players who use the same email address for Xbox live as they already use for our forums & website.

Is it something that requires a change to the core codebase, or something that we can fix with a setting/SPI etc?

---

<div class="post-metadata">

**Author:** ![gklijs](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gklijs/32/1706_2.png) [@gklijs](https://forum.keycloak.org/u/gklijs)\
**Post date:** [November 18, 2020, 5:26pm UTC](https://forum.keycloak.org/t/enabling-account-linking-with-external-token-exchange/2183/2 "2020-11-18T17:26:07Z")

</div>

Did you find an answer, or maybe somebody else? We are running into a similar issue currently.

---

<div class="post-metadata">

**Author:** ![edL](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@edL](https://forum.keycloak.org/u/edL)\
**Post date:** [November 19, 2020, 10:23pm UTC](https://forum.keycloak.org/t/enabling-account-linking-with-external-token-exchange/2183/3 "2020-11-19T22:23:55Z")

</div>

We did, but we didn’t use token exchange. It would have required changes to the core codebase, which the KeyCloak team was reluctant to accept on security/privacy grounds.

Instead, we found that both Xbox Live and PlayStation Network implemented enough of the OpenID Connect protocol to enable us to use custom Identity Provider SPIs.

We were able to copy the Microsoft Identity Provider from the core codebase and modify it to create two new providers which handled XBL and PSN.

---

<div class="post-metadata">

**Author:** ![gklijs](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gklijs/32/1706_2.png) [@gklijs](https://forum.keycloak.org/u/gklijs)\
**Post date:** [November 19, 2020, 10:41pm UTC](https://forum.keycloak.org/t/enabling-account-linking-with-external-token-exchange/2183/4 "2020-11-19T22:41:26Z")

</div>

We ‘solved’ it by mapping the username and email for the identity provider used with the exchange. This way it’s not interfering with the other login options.

---

<div class="post-metadata">

**Author:** ![elangor](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/elangor/32/5352_2.png) [@elangor](https://forum.keycloak.org/u/elangor)\
**Post date:** [March 17, 2022, 5:09pm UTC](https://forum.keycloak.org/t/enabling-account-linking-with-external-token-exchange/2183/5 "2022-03-17T17:09:48Z")

</div>

@gklijs - Can you please provide more information on your solution. I also have an similar problem where I need to link existing users with token change to an IDP.