The background to this is that we have Apex code using the Pardot API. Soon, the authentication for that will need to use a Salesforce session id. So, we created a Connected App, Auth. Provider, and Named Credential to make things work.
This all works fine as long as you create the Named Credential whilst logged in as the user who will be the Named Principle.
However, we need to use an Identity User licence as the Named Principle with minimal permissions so that they can only do Pardot.
Identity users cannot access the setup menu, so I can't just log in as that user and create the Named Credential.
If I log in as admin, then try to authenticate the Named Credential as the identity user, it seems that my admin session is replaced in the browser by the identity user one. Which means the OAuth fails at the callback stage - I land on the callback page, but not logged in as the user who started it, and with no permission to finish the setup.
I've tested the overall setup both by creating the Named Credential as admin, and by using Postman to OAuth as the Identity User. Both of these work.
Maybe I can build some UI and Apex which the Identity User can use to hit the API and create a Named Credential that way? Maybe I can create the Named Credential from outside of Salesforce using the API and both OAuths?
It all seems like a lot of work for something that should be simple.
I've tried the method from Initiate an oAuth flow via an Auth Provider
This gets approximately the same result, the image attached