The "Token Exchange May Act Script" is used to determine if a client is permitted to impersonate another identity during an OAuth2 token exchange. This script can be configured globally for all clients under the realm's OAuth2 Provider service on the "Advanced" tab. To provide more granular control, this global setting can be overridden for a specific client within that client's profile on the "OAuth2 Provider Overrides" tab page. This dual-level configuration allows for both a default policy and client-specific exceptions.

A and C only: This option incorrectly includes the client's "Advanced" tab and omits the correct global configuration location on the provider's "Advanced" tab.

B and D only: This is the correct combination of options.

D and C only: This option incorrectly includes the provider's "Core" tab and the client's "Advanced" tab, neither of which is used for configuring this script.

1. Ping Identity Access Management Documentation, "OAuth 2.0 Provider Service advanced settings". This page details the "Token Exchange May Act Script" setting on the Advanced tab of the OAuth2 Provider service.

2. Ping Identity Access Management Documentation, "OAuth 2.0 Provider Overrides tab". This page explains that settings from the OAuth2 Provider service, including scripts, can be overridden for individual clients on this tab.