From a33f1683ffe4985d9cbdcca8e1cc93878b2fc858 Mon Sep 17 00:00:00 2001
From: Jaime Conde <conde-segovia@univention.de>
Date: Mon, 28 Jul 2025 15:31:37 +0200
Subject: [PATCH] fix(intercom): New Keycloak Token Exchange flags

---
 .../apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl  | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
index 0bc3b2a7..04ef722c 100644
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -527,7 +527,10 @@ config:
         publicClient: false
         authorizationServicesEnabled: false
         attributes:
+          use.refresh.tokens: true
           backchannel.logout.session.required: true
+          standard.token.exchange.enabled: true
+          standard.token.exchange.enableRefreshRequestedTokenType: "SAME_SESSION"
           backchannel.logout.revoke.offline.tokens: true
           backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
         protocolMappers: