Today we have SSO session max and idle, but there is no way to control duration for individual clients. One side-effect of this is that if the SSO session max is very large all refresh tokens will have a long expiration time. It is also related to max_age parameter. As tokens have a long expiration the only way to control it is the client has to manually check auth_time in the tokens. One idea is that we could introduce a Client Session Max and Idle. The realm would allow setting a default value, but it would also be possible to override on a per-client basis. If not set for realm or client it would fallback to SSO Session Max/Idle For Client Session Max implementation should be pretty straight forward. When issuing tokens we make sure the expiration is set according to the Clients Session Max. For Client Session Idle implementation should also be pretty straight forward. Tokens would only be valid if within Client Session Idle. As long as clients refresh tokens they will get newly issued tokens that would be within the Client Session Idle, up until they reach Client Session Max when the refresh token would no longer be valid and the client would need to do a new authentication request to obtain new tokens. We should also add default_max_age to clients, which would make it possible to easily configure re-authentication for specific clients.