I face a situations where the access token claim A has no value, it needs to obtain a new token with additional scopes, I want to avoid re-authenticating the account credentials. Therefore, I’m looking to use Token Exchange to get a new access token with the additional scopes. However, no matter how I configure the scope range, there is no change in the resulting token.

Is Token Exchange unable to change the scope?

grant_type by password

grant_type by token-exchange

KeyCloak 25.0.4