Seems there are 2 things here:
1) Username "hint" provided by KEYCLOAK_REMEMBERME cookie. IMO this
cookie should be deleted only when:
- User explicitly clicked on logout and maually logout himself
- User click on "Login" button on login screen without the rememberme
IMO it shouldn't be deleted when SSO cookie is expired, which is current
behaviour and should be changed IMO. In other words, I expect the
scenario working like:
- User logged with "rememberMe" checkbox on
- User closed the browser
- After a month, user returned back to the application. His SSO session
is expired, but KEYCLOAK_REMEMBERME cookie won't be deleted, so on login
screen he will see the prefilled username and rememberMe checkbox
switched to "on"
2) Persistent KEYCLOAK_IDENTITY cookie when rememberMe is switched to
on. I can't see how it can work when session is expired as it relies on
session in the cookie value. On the other hand, rememberMe shouldn't
rely on "SSO Session idle timeout" IMO. SSO IDle timeout is only 30
minutes by default. So current behaviour is, that when user closes his
browser, he needs to open in again and being re-authenticated only when
he do within 30 minutes, which is bit of pointless IMO.
I would suggest to change the behaviour like this:
- When userSession is marked as rememberMe, then cleaner thread will
take into account just "SSO Max Lifespan" timeout, but not SSO Idle timeout
- During verification of SSO cookie re-authentication and when session
is rememberMe, we will take into account just SSO Max Lifespan of
session, but not SSO Idle timeout
Refreshing of tokens will still take SSO Idle timeout just like now.
If we not change the behaviour like this, we should at least update
"RememberMe" docs and tooltip to make it more clear what the behaviour
would be in various cases.
On 31/03/16 16:26, Libor Krzyzanek wrote:
I read docs today
and my understanding is that user should keep logged in after either
browser restart or session expiration.
My tests shows that after session expiration (set to 1 min) I have to
log in again.
Principal Software Engineer
Red Hat Developers | Engineering
> On Mar 31, 2016, at 3:00 PM, Marek Posolda <mposolda(a)redhat.com
> <mailto:firstname.lastname@example.org>> wrote:
> Followup on the issue by Libor  . I can confirm to see the same
> behaviour in the OOTB Keycloak, like Libor described in the JIRA. In
> other words, when you refresh account page (
) but the UserSession
> referenced from KEYCLOAK_IDENTITY cookie is expired, then all cookies
> including KEYCLOAK_REMEMBERME are expired too.
> IMO RememberMe cookie shouldn't be expired when session is expired.
> We're using the rememberMe cookie as hint for username on the login
> page. So even if user returns to page after a month, I am not seeing
> anything bad that rememberMe cookie is still valid and user will see
> "hint" with his username on login page and rememberMe checkbox checked
> even if session was expired already for a long time. IMO the only
> situation when we should expire KEYCLOAK_REMEMBERME cookie is, when user
> unchecks the "Remember me" checkbox on login page.
>  https://issues.jboss.org/browse/ORG-2956
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org <mailto:email@example.com>