title: Keycloak - Impersonation - Set-cookie header NOT saving in browser cookies (KEYCLOAK_SESSION, KEYCLOAK_IDENTITY)
body: <p>I see this question was answered in many forums and answered in many ways - Most of the Answers are we are doing in the same way.</p>
  <p>Still, we see that Set-Cookie is NOT SAVING INTO BROWSER - due to this Keycloak is Not able to recognize the Impersonation Login Session.</p>
  <p><strong>Here is the Request (done via Angular)</strong></p>
  <pre><code>const url = environment.BASE_URL + 'realms/master/custom/realms/REALM_NAME/users/' + userName + '/impersonation';
    const headers = new Headers();
    headers.append('Authorization', 'Bearer ' + user.adminToken);
    headers.append('Access-Control-Allow-Origin', '*')
    const options = new RequestOptions({ method: RequestMethod.Post, headers: headers });
    options.withCredentials = true;
    return this._http
      .post(url, JSON.stringify(representativeDetails), options)
      .map((response: Response) =&gt; response.json())
      .catch(this.handleErrorObservable);
  </code></pre>
  <p><strong>Here is the Response sent from our Java application</strong></p>
  <pre><code>return Response.ok(result)
  .header(HttpHeaders.CONTENT_TYPE, org.keycloak.utils.MediaType.APPLICATION_JSON)
  .header(&quot;Access-Control-Allow-Origin&quot;, origin)
  .header(&quot;Access-Control-Allow-Methods&quot;, CollectionUtil.join(new HashSet(Arrays.asList(&quot;GET&quot;, &quot;PUT&quot;, &quot;POST&quot;, &quot;DELETE&quot;))))
  .header(&quot;Access-Control-Allow-Headers&quot;, &quot;Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Access-Control-Allow-Origin&quot;)
  .header(&quot;Access-Control-Max-Age&quot;, 1234)
  .header(&quot;Access-Control-Allow-Credentials&quot;, true)
  .header(&quot;Access-Control-Expose-Headers&quot;, &quot;*&quot;)
  .build();
  </code></pre>
  <p>Below I copied from my browser where we can see all the <strong>Request</strong> and <strong>Response</strong> Headers</p>
  <p><strong>Response Headers</strong></p>
  <pre><code>access-control-allow-headers: Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Access-Control-Allow-Origin
  access-control-allow-methods: DELETE, POST, GET, PUT
  access-control-allow-origin: https://DOMAINNAME.COM
  access-control-expose-headers: *
  access-control-max-age: 1234
  cache-control: NO-CACHE
  content-length: 108
  content-type: application/json
  date: Fri, 28 Jan 2022 20:31:19 GMT
  p3p: CP=&quot;This is not a P3P policy!&quot;
  pragma: NO-CACHE
  referrer-policy: no-referrer
  set-cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInXXXXXXX--------tm_sC4lnc; Version=1; Path=/; SameSite=None; Secure; HttpOnly
  set-cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInXXXXXXX--------tm_sC4lnc; Version=1; Path=/; Secure; HttpOnly
  set-cookie: KEYCLOAK_SESSION=REALM_NAME/065ec370-e803-4351-9a06; Version=1; Expires=Mon, 07-Feb-2022 20:31:19 GMT; Max-Age=864000; Path=/; SameSite=None; Secure
  set-cookie: KEYCLOAK_SESSION_LEGACY=REALM_NAME/065ec370-e803-4351-9a06; Version=1; Expires=Mon, 07-Feb-2022 20:31:19 GMT; Max-Age=864000; Path=/; Secure
  set-cookie: AUTH_SESSION_ID=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/; Secure; HttpOnly
  set-cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/; Secure; HttpOnly
  strict-transport-security: max-age=31536000; includeSubDomains
  x-content-type-options: nosniff
  x-frame-options: SAMEORIGIN
  x-xss-protection: 1; mode=block
  
  **Request Headers**
  
  :authority: SSO_BASE_URL.COM
  :method: POST
  :path: /auth/realms/master/custom/realms/REALM_NAME/users/USER_ID/impersonation
  :scheme: https
  accept: application/json, text/plain, */*
  accept-encoding: gzip, deflate, br
  accept-language: en-US,en;q=0.9,hi;q=0.8,en-IN;q=0.7
  access-control-allow-origin: *
  authorization: Bearer TOKEN_TOKEN_TOKEN
  cache-control: no-cache
  content-length: 36
  content-type: application/json
  cookie: AUTH_SESSION_ID=d1d12d09-3; 
  AUTH_SESSION_ID_LEGACY=d1d12d09-3; 
  KEYCLOAK_SESSION=master/eda99620-92e2-4; 
  KEYCLOAK_SESSION_LEGACY=master/eda99620-92e2-4; 
  KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiI------------; KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiI------------;
  LanguageDisplayDirection=ltr; 
  SplashScreen=false; 
  cookiebanner=false; 
  origin: https://DOMAINNAME.COM
  pragma: no-cache
  referer: https://DOMAINNAME.COM/
  sec-ch-ua: &quot; Not;A Brand&quot;;v=&quot;99&quot;, &quot;Google Chrome&quot;;v=&quot;97&quot;, &quot;Chromium&quot;;v=&quot;97&quot;
  sec-ch-ua-mobile: ?0
  sec-ch-ua-platform: &quot;Windows&quot;
  sec-fetch-dest: empty
  sec-fetch-mode: cors
  sec-fetch-site: same-site
  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36
  </code></pre>
  <p>Here is Keycloak Server Source Code and logic to create the Login Cookie</p>
  <p><a href="https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java" rel="nofollow noreferrer">https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java</a></p>
  <p><a href="https://i.stack.imgur.com/0TyP2.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0TyP2.png" alt="createLoginCookie" /></a></p>
  <p><a href="https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java" rel="nofollow noreferrer">https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java</a></p>
  <p><a href="https://i.stack.imgur.com/qCDkI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qCDkI.png" alt="createLoginCookie" /></a></p>