Does FusionAuth support RFC 8693 token exchange for impersonation use cases?

FASupportBot

We are considering migrating a custom token exchange endpoint to FusionAuth and want to understand FusionAuth's RFC 8693 token exchange support.

Specifically, we need to know:

Does FusionAuth support the impersonation aspect of RFC 8693?
What claims are included in tokens issued via token exchange?
Is this suitable for implementing user impersonation flows in a standards-compliant way?

FASupportBot

Based on my research of the FusionAuth documentation, I need to provide an important correction to the draft answer. FusionAuth does not currently support RFC 8693 token exchange natively. Here's the improved answer:

Answer

Important Clarification: FusionAuth does not currently support RFC 8693 token exchange natively. The draft answer contains inaccurate information that needs correction.

Current RFC 8693 Status:

Native RFC 8693 token exchange is not implemented in FusionAuth
There is an open GitHub issue (#1471) tracking this feature request for implementing impersonation and delegation tokens according to RFC 8693
No confirmed ETA is available for this feature

Workarounds for Token Exchange and Impersonation:

While native RFC 8693 support is unavailable, FusionAuth offers alternative approaches:

1. Vend JWT API for Delegation

You can use FusionAuth's Vend a JWT endpoint to create custom tokens that include an act claim, following RFC 8693 delegation chain semantics:

const response = await client.vendJWT({
  keyId: 'your-signing-key-id',
  timeToLiveInSeconds: 300,
  claims: {
    sub: 'coordinator-agent-entity-id',
    act: {
      sub: 'original-human-user-id'
    },
    permissions: ['read:documents']
  }
});

This approach provides delegation semantics where the original actor is tracked in the act claim.

2. Impersonation Implementation

For pure impersonation (without delegation tracking), you can implement this at the API level:

Create a backend endpoint (e.g., /api/impersonate/{id}) that verifies the requesting user is an admin
Use the Vend JWT API to directly construct a token for the target user
Manage the impersonated session in your application

Note: Impersonation via the OAuth/OIDC workflow is not supported as it would conflict with the OAuth specification.

3. Other Alternatives

Consolidate services under a single application registration
Alter the aud claim via a JWT lambda
Pass two separate JWTs in different headers (one for the service, one for the user)

Recommendation:
If standards-compliant RFC 8693 token exchange is a hard requirement for your migration, you may want to track or upvote the GitHub issue mentioned above. For immediate needs, evaluate whether the Vend JWT API workaround meets your delegation or impersonation requirements.

Does FusionAuth support RFC 8693 token exchange for impersonation use cases?

Answer

1. Vend JWT API for Delegation

2. Impersonation Implementation

3. Other Alternatives

Related Documentation