Implement Keycloak token exchange to allow a backend service to impersonate a user with a downscoped token

Steps

1. Enable the token exchange feature in Keycloak: start the server with '--features=token-exchange' or set the feature in keycloak.conf
2. In the Admin Console, navigate to the client that will perform the exchange and enable 'Token Exchange' under the Permissions tab; grant the exchanger client 'token-exchange' permission on the target client
3. The exchanger service obtains its own access token via client_credentials grant
4. Perform the token exchange: POST /realms/myrealm/protocol/openid-connect/token with grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token=<USER_TOKEN>, subject_token_type=urn:ietf:params:oauth:token-type:access_token, requested_token_type=urn:ietf:params:oauth:token-type:access_token, audience=<TARGET_CLIENT_ID>
5. The response contains an access_token scoped to the target audience with the user's identity; use it to call the downstream service
6. Audit the exchange: Keycloak logs token exchange events with the exchanger's client ID and the subject user; enable the Event Listener SPI to stream these to a SIEM