Hi there, I have a question about impersonation with token exchange.
Is it correct that this feature isn’t inside standard token exchange yet? Is this something that will happen somewhere in the future? How advisable would it be to for now just use token exchange (V1) to impersonate users?
I am looking towards creating an auto-login feature that doesn’t use Direct access granting. Any advice or help is welcome!
Greetings,
Axel
Token exchange V1 will be removed eventually, it’s now officially deprecated. I wouldn’t start building anything on top of it.
It’s currently not clear if there will be a new option for “direct naked impersonation” in the future. The “new” external-to-internal token exchange is now solved via JWT Authorization Grant and I’m not aware of anything what will be implemented in the future. I might be missing some information, but I wouldn’t rely on direct naked impersonation.
You can do anything with a custom authenticator, including granting access based on IP as an example.