Does FusionAuth support RFC 8693 token exchange for impersonation use cases?

FASupportBot — Invalid Date

Based on my research of the FusionAuth documentation, I need to provide an important correction to the draft answer. FusionAuth does not currently support RFC 8693 token exchange natively. Here's the improved answer:

Answer

Important Clarification: FusionAuth does not currently support RFC 8693 token exchange natively. The draft answer contains inaccurate information that needs correction.

Current RFC 8693 Status:

Native RFC 8693 token exchange is not implemented in FusionAuth There is an open GitHub issue (#1471) tracking this feature request for implementing impersonation and delegation tokens according to RFC 8693 No confirmed ETA is available for this feature

Workarounds for Token Exchange and Impersonation:

While native RFC 8693 support is unavailable, FusionAuth offers alternative approaches:

1. Vend JWT API for Delegation

You can use FusionAuth's Vend a JWT endpoint to create custom tokens that include an act claim, following RFC 8693 delegation chain semantics:

const response = await client.vendJWT({ keyId: 'your-signing-key-id', timeToLiveInSeconds: 300, claims: { sub: 'coordinator-agent-entity-id', act: { sub: 'original-human-user-id' }, permissions: ['read:documents'] } });

This approach provides delegation semantics where the original actor is tracked in the act claim.

2. Impersonation Implementation

For pure impersonation (without delegation tracking), you can implement this at the API level:

Create a backend endpoint (e.g., /api/impersonate/{id}) that verifies the requesting user is an admin Use the Vend JWT API to directly construct a token for the target user Manage the impersonated session in your application

Note: Impersonation via the OAuth/OIDC workflow is not supported as it would conflict with the OAuth specification.

3. Other Alternatives Consolidate services under a single application registration Alter the aud claim via a JWT lambda Pass two separate JWTs in different headers (one for the service, one for the user)

Recommendation:
If standards-compliant RFC 8693 token exchange is a hard requirement for your migration, you may want to track or upvote the GitHub issue mentioned above. For immediate needs, evaluate whether the Vend JWT API workaround meets your delegation or impersonation requirements.

Related Documentation Vend a JWT API - API for creating custom JWTs with specified claims OAuth 2.0 Grant Types - Token Exchange Grant - Overview of RFC 8693 token exchange concept GitHub Issue #1471: Implement Impersonation and Delegation Tokens (RFC 8693) - Open feature request Forum: Does Fusionauth have an "impersonation" feature? - Community discussion on impersonation approaches Forum: Does FusionAuth Support UMA Grant and Token Exchange (RFC 8693)? - Related community discussion

Topics tagged with impersonation

Does FusionAuth support RFC 8693 token exchange for impersonation use cases?