[keycloak-user] Schedule background jobs as user

Jesse Chahal jessec at stytch.com
Wed May 25 20:25:17 EDT 2016


I did not look at the example but as you can see from the end of the
last email we would very much like to not redirect the user back to
the login screen. I assumed this was a possible way of getting an
offline_token already as it would be comparable to other applications
using similar protocols asking for elevated permissions. Usually those
other applications would be using an external identity provider. This
starts to reduce the native feel of the authentication system
(keycloak) + the application. Our application is a 1st party app
(meaning keycloak+app should appear to be a single app) and our UX
team is very much against the experience provided by requiring
reauthentication to schedule background jobs with ourselves.

On Tue, May 24, 2016 at 10:01 PM, Stian Thorgersen <sthorger at redhat.com> wrote:
> Did you look at the offline-access-app from our examples? You could use
> regular login with the adapters, but when the application needs an offline
> token and doesn't already have one direct the user to the login and include
> ?scope=offline_access. If the user is already authenticated and the client
> doesn't require consent no login page will be displayed.
>
> On 20 May 2016 at 19:42, Jesse Chahal <jessec at stytch.com> wrote:
>>
>> Thanks for the info, looks like I was on the right path. After reading
>> through the OpenID spec I came across offline tokens and saw that it
>> was supported by keycloak. I was trying to figure out how to use
>> offline tokens with the adapter (since it didn't seem possible to set
>> a flag to enable the scope for this) but based on the above it isn't
>> possible. Is it possible for a client to request an offline token
>> using a refresh or access token? The reason I ask is because we cannot
>> request it using the adapter system that we are currently using. Even
>> if we could with the adapter system that would mean that for every
>> single login we would be requesting a offline token instead of a
>> refresh token (seems like a bad idea). It also seems like a good idea
>> to only request the offline_token if a user decides to schedule a
>> offline job with us. We would prefer not having to have the user login
>> again in order to schedule an offline job. I did some initial tests
>> using a rest client and it did not seem possible.
>>
>> On Thu, May 19, 2016 at 10:34 PM, Stian Thorgersen <sthorger at redhat.com>
>> wrote:
>> > This is exactly what offline tokens where created to do. The offline
>> > token
>> > is not linked to user sessions so it doesn't matter if users login or
>> > not.
>> > Our adapters doesn't support it properly though so you'd need to create
>> > a
>> > filter or something that sets up the context and principle based on the
>> > offline token.
>> >
>> > On 19 May 2016 at 19:56, Jesse Chahal <jessec at stytch.com> wrote:
>> >>
>> >> So we've done a lot of work on our migration to keycloak but still
>> >> have a few holes that are using another authentication system. We are
>> >> using Wildfly10 along with the keycloak subsystem. The last real
>> >> blocking issues is trying to schedule background tasks on behalf of a
>> >> user using quartz. We've tried using impersonation role and mocking
>> >> out the impersonation workflow that a browser does, it was fairly
>> >> complicated and did not work very well. Service accounts don't seem to
>> >> fit this scenario either as service accounts seem to be for performing
>> >> client specific actions. We considered storing offline token's on
>> >> behalf of users but the thing is users might not log in for years
>> >> after scheduling their job. We need to set the Context and Principle
>> >> to be the user who we are performing background tasks on behalf of. Is
>> >> there a recommended way of doing this that has been tested by others?
>> >> I'm sure we aren't the only company who schedule tasks on behalf of
>> >> users.
>> >> _______________________________________________
>> >> keycloak-user mailing list
>> >> keycloak-user at lists.jboss.org
>> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>> >
>
>


More information about the keycloak-user mailing list