I have installed and configured an identity provider and it is working as expected via the browser and also with a native Apple sign in on macOs via Token Exchange.
When authenticating via a browser, keycloak uses the built-in first broker login flow.
It is also possible to configure First login flow override and Post login flow in the Provider settings.
However it seems that these flows are not triggered when I use Token Exchange. Is this expected behaviour?
Do you have any advice on strategy to trigger a flow after or during token exchange?
Our use case: We are migrating existing users from our system to keycloak. When an existing user authenticates, we want to update a custom userId attribute in keycloak with their userId from our current system. We can do this with a custom authenticator which will run after the user authenticates via the browser, however because the first broker login flow and First login flow override and Post login flow are not run when performing a Token Exchange, the custom authenticator will not run.