Im trying to get an example to work where a token is exchanged between multiple clients.

there are 3 clients service-1-client, service-2-client, service-3-client and public-spa.

i get it wo work when i get the initial token using grant_type=password on service-1-client.

but when i start with an initial token (1)

• using grant-type=client_credentials onservice-1-client
• using grant_type=password on public-spa

then can successfully exchange token (1) to token (2) for service-2-client.
but when i finally want to exchange that token (2) for service-3-client then token-exchange fails with.

HTTP/1.1 400 Bad Request
{"error":"invalid_token","error_description":"Invalid token"}

on DEBUG-log we see Client session for client 'service-1-client' not present in user session '...'

DEBUG [org.keycloak.authentication.AuthenticationProcessor] (executor-thread-1) AUTHENTICATE CLIENT
DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (executor-thread-1) client authenticator: client-secret
DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (executor-thread-1) client authenticator SUCCESS: client-secret
DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (executor-thread-1) Client service-2-client authenticated by client-secret
DEBUG [org.keycloak.services.managers.AuthenticationManager] (executor-thread-1) Client session for client 'service-1-client' not present in user session 'f7710145-afca-4f08-b14a-076c87ecac6b'
WARN  [org.keycloak.events] (executor-thread-1) type="TOKEN_EXCHANGE_ERROR", realmId="05e5e1a6-657f-42ba-84c0-fc9046a8d4e3", clientId="service-2-client", userId="null", ipAddress="192.168.48.1", error="invalid_token", reason="subject_token validation failure", auth_method="token_exchange", grant_type="urn:ietf:params:oauth:grant-type:token-exchange", client_auth_method="client-secret"

I cannot see what i missed – is should be possible to make token-exchange over sevaral services even if the initial token is form a (frontend) SPA or a background-task in a service where grant_type=client_credentials is used.

reproducing repo see https://github.com/flyinfish/keycloak-examples/blob/main/token-exchange-sequence/README.md