I am using Keycloak 17.0 with
keycloak.profile.feature.admin_fine_grained_authz=enabled
keycloak.profile.feature.token_exchange=enabled
The issue: I need to provide refresh token for a client on behalf of already authenticated confidential service account client. I need something very close to internal to internal token exchange like it's described here. The only thing is that I need to make a token exchange call without subject_token parameter. Is it possible to have a client that will provide tokens for another internal clients without their authentication/tokens?