title: Keycloak impersonation API not implemented
body: <p>I've been trying to use the Keycloak Impersonation API (semi-recent addition) to get an access token for another user. I have created a semi-successful CURL request based on the <a href="https://www.keycloak.org/docs/5.0/securing_apps/index.html#impersonation" rel="nofollow noreferrer">docs</a> and another <a href="https://stackoverflow.com/questions/49844148/keycloak-access-impersonate-api">StackOverflow question</a>. The CURL request (<em>below</em>) returns a <code>501 Not Implemented</code> and I am trying to figure this out. If it would be another error I would assume I am doing something incorrectly, but this appears to be at least partially correct.</p>
  
  <pre><code>curl --verbose -X POST "http://localhost:8081/auth/realms/master/protocol/openid-connect/token" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
   -d "client_id=admin-cli" \
   -d "requested_subject={TARGET_USER_ID}" \
   -d "subject_token={USER_MANAGER_TOKEN}"
  </code></pre>
  
  <p>My workflow so far has been to get the Keycloak master realm "admin" user's access token (successful) and use that in the impersonation request, along with the target user's Keycloak ID. Am I doing something wrong or missing a step?</p>
  
  <p><strong>I haven't changed any Keycloak permissions, is this required?</strong></p>
  
  <p>From my understanding and the documentation, impersonation is currently supported and enabled by default in <a href="https://www.keycloak.org/docs/5.0/server_installation/#profiles" rel="nofollow noreferrer">Keycloak v5 - Sever Installation</a>. However, another article (<a href="https://www.keycloak.org/docs/5.0/securing_apps/index.html#_token-exchange" rel="nofollow noreferrer">Keycloak v5 - Token Exchange</a>) seems to indicate that the feature is disabled by default; could this be why I am getting the <code>501 Not Implemented</code>? </p>
  
  <p><strong>EDIT:</strong> @qdivision mentioned that the Token Exchange needs to be enabled for this to work. However, we are using the <code>jboss/keycloak</code> Docker image and I am wondering where I should add the <code>profile.properties</code> file to enable this feature?</p>