Some thoughts around offline tokens impl: - Client has switch "Allow offline tokens" . Offline token can be requested just if the switch is enabled - Offline token can be requested if parameter "scope=offline" is sent. Offline token is sent alone, no IDToken or refreshToken is sent together with it. Question: Should be offline tokens available just for ResourceOwnerPasswordCredentials and ServiceAccounts or also for classic web based authorization code flow? - There are methods on UserModel to track which offline tokens were issued for particular user. Like: List<String> getOfflineTokens(); void addOfflineToken(String offlineToken); void removeOfflineToken(String offlineToken); - Offline token will never expire. Or should we eventually add another timeout for offline token (With some big default value like 1 month or so)? - Offline token is not refreshable. - Offline token can be validated by current OIDC endpoint for token validation. Offline token is not valid if UserModel doesn't have token anymore on it. But offline token is still valid even if corresponding UserSession doesn't exist. So we can still have offline tokens valid for 1 year even if SsoSessionMaxLifespan is just 10 hours. - Offline token can be logged out. Logout will remove offline token from corresponding UserModel. - In Account management applications page can user see list of offline tokens issued for individual clients and he can revoke them. Not sure if put another "Revoke offline token" or use current "Revoke grant" action, which will revoke both consents and offline tokens? - Admin can see the offline tokens for user in admin console and can revoke them too . Current button "Logout All" in sessions tab will revoke offline tokens from all users . For performance reasons, we may need method on UserProvider, so it's possible to clean whole DB table "OFFLINE_TOKEN" (similarly for mongo) instead of iterating through all users. - For adapters, we should likely have an option, so the REST endpoint adapter has possibility to validate offline token by always sending validation request to KC server. We didn't need it for access tokens, which are valid just for 1 minute or so, but offline tokens are long lived so adapter should have this possibility IMO.

WDYT? Marek _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

On 8/21/2015 8:09 AM, Marek Posolda wrote: > - Actually, for the frontend adapters (both server and keycloak.js ) I > am thinking about adding the persistent cookie, which will be put on the > application after successful login and is valid for the same time like > the offline token (so couple of months). When browser is opened next > time, the adapter will find the cookie and send the validation request > to KC to check if offline token is still valid. This will allow the > browser application to be logged with the same offline token for couple > of months. > I don't understand why you need an offline token for browser applications. We already support persistent cookies.

From: "Marek Posolda" <mposolda(a)redhat.com&gt; To: "Bill Burke" <bburke(a)redhat.com&gt;, keycloak-dev(a)lists.jboss.org Sent: Monday, 31 August, 2015 3:06:48 PM Subject: Re: [keycloak-dev] Offline tokens Actually KEYCLOAK_IDENTITY cookie is persistent just for the configured idle timeout (like 30 minutes). But for the offline token, I imagine we want to support the scenario when user authenticates to his application after a week of inactivity or so.

Here I meant the cookie will be on the application side, not on the KC side. When user opens his browser and goes to http://localhost:8080/customer-portal , the application (adapter) side will read the offline token from the persistent cookie and then login user based on that.

Marek On 21/08/15 14:50, Bill Burke wrote: > > On 8/21/2015 8:09 AM, Marek Posolda wrote: >> - Actually, for the frontend adapters (both server and keycloak.js ) I >> am thinking about adding the persistent cookie, which will be put on the >> application after successful login and is valid for the same time like >> the offline token (so couple of months). When browser is opened next >> time, the adapter will find the cookie and send the validation request >> to KC to check if offline token is still valid. This will allow the >> browser application to be logged with the same offline token for couple >> of months. >> > I don't understand why you need an offline token for browser > applications. We already support persistent cookies. > _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

From: "Marek Posolda" <mposolda(a)redhat.com&gt; To: keycloak-dev(a)lists.jboss.org Sent: Friday, 21 August, 2015 2:09:31 PM Subject: Re: [keycloak-dev] Offline tokens On 21/08/15 13:30, Marek Posolda wrote: > Some thoughts around offline tokens impl: > > - Client has switch "Allow offline tokens" . Offline token can be > requested just if the switch is enabled > > - Offline token can be requested if parameter "scope=offline" is sent. > Offline token is sent alone, no IDToken or refreshToken is sent together > with it. > Question: Should be offline tokens available just for > ResourceOwnerPasswordCredentials and ServiceAccounts or also for classic > web based authorization code flow? > > - There are methods on UserModel to track which offline tokens were > issued for particular user. Like: > > List<String> getOfflineTokens(); > void addOfflineToken(String offlineToken); > void removeOfflineToken(String offlineToken); > > - Offline token will never expire. Or should we eventually add another > timeout for offline token (With some big default value like 1 month or so)? > > - Offline token is not refreshable. > > - Offline token can be validated by current OIDC endpoint for token > validation. Offline token is not valid if UserModel doesn't have token > anymore on it. But offline token is still valid even if corresponding > UserSession doesn't exist. So we can still have offline tokens valid for > 1 year even if SsoSessionMaxLifespan is just 10 hours. > > - Offline token can be logged out. Logout will remove offline token from > corresponding UserModel. > > - In Account management applications page can user see list of offline > tokens issued for individual clients and he can revoke them. Not sure if > put another "Revoke offline token" or use current "Revoke grant" action, > which will revoke both consents and offline tokens? > > - Admin can see the offline tokens for user in admin console and can > revoke them too . Current button "Logout All" in sessions tab will > revoke offline tokens from all users . For performance reasons, we may > need method on UserProvider, so it's possible to clean whole DB table > "OFFLINE_TOKEN" (similarly for mongo) instead of iterating through all > users. > > - For adapters, we should likely have an option, so the REST endpoint > adapter has possibility to validate offline token by always sending > validation request to KC server. We didn't need it for access tokens, > which are valid just for 1 minute or so, but offline tokens are long > lived so adapter should have this possibility IMO. - Actually, for the frontend adapters (both server and keycloak.js ) I am thinking about adding the persistent cookie, which will be put on the application after successful login and is valid for the same time like the offline token (so couple of months). When browser is opened next time, the adapter will find the cookie and send the validation request to KC to check if offline token is still valid. This will allow the browser application to be logged with the same offline token for couple of months. I also wonder if we should put the IP address checking when validating offline token (Offline token is valid just if validation request come from same address like the original request) ?

Mare > > WDYT? > > Marek > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

- Offline token can be requested if parameter "scope=offline" is sent. Offline token is sent alone, no IDToken or refreshToken is sent together with it. Question: Should be offline tokens available just for ResourceOwnerPasswordCredentials and ServiceAccounts or also for classic web based authorization code flow?

- Offline token will never expire. Or should we eventually add another timeout for offline token (With some big default value like 1 month or so)?

- Offline token can be validated by current OIDC endpoint for token validation. Offline token is not valid if UserModel doesn't have token anymore on it. But offline token is still valid even if corresponding UserSession doesn't exist. So we can still have offline tokens valid for 1 year even if SsoSessionMaxLifespan is just 10 hours.

- Offline token can be logged out. Logout will remove offline token from corresponding UserModel.

- In Account management applications page can user see list of offline tokens issued for individual clients and he can revoke them. Not sure if put another "Revoke offline token" or use current "Revoke grant" action, which will revoke both consents and offline tokens?

- Admin can see the offline tokens for user in admin console and can revoke them too . Current button "Logout All" in sessions tab will revoke offline tokens from all users . For performance reasons, we may need method on UserProvider, so it's possible to clean whole DB table "OFFLINE_TOKEN" (similarly for mongo) instead of iterating through all users.

- For adapters, we should likely have an option, so the REST endpoint adapter has possibility to validate offline token by always sending validation request to KC server. We didn't need it for access tokens, which are valid just for 1 minute or so, but offline tokens are long lived so adapter should have this possibility IMO.

Marek, On 08/21/2015 01:30 PM, Marek Posolda wrote: > - Offline token can be requested if parameter "scope=offline" is sent. > Offline token is sent alone, no IDToken or refreshToken is sent together > with it. > Question: Should be offline tokens available just for > ResourceOwnerPasswordCredentials and ServiceAccounts or also for classic > web based authorization code flow? Not quite sure what ResourceOwnerPasswordCredentials is (is it something new?),

but I think that having the possibility of requesting an offline token based on a bearer token is desirable. In my case, I intend to have a "token exchange proxy", where the end user would create API keys for the agent. This API key is an UUID, that relates to a token that I'd store in Hawkular's backend. Whenever I get this token, I retrieve the offline token and use it for backend operations, as if the user were online. This means: I don't intend to have access to the user's password at any point when creating or sending offline tokens.

> - Offline token will never expire. Or should we eventually add another > timeout for offline token (With some big default value like 1 month or so)? It should never expire. Or at most, there should be a setting for the realm/client that would allow the offline token to never expire. It can, however, be revoked. > - Offline token can be validated by current OIDC endpoint for token > validation. Offline token is not valid if UserModel doesn't have token > anymore on it. But offline token is still valid even if corresponding > UserSession doesn't exist. So we can still have offline tokens valid for > 1 year even if SsoSessionMaxLifespan is just 10 hours. +1 > - Offline token can be logged out. Logout will remove offline token from > corresponding UserModel. I guess this is the revoked part I mentioned above, right? > - In Account management applications page can user see list of offline > tokens issued for individual clients and he can revoke them. Not sure if > put another "Revoke offline token" or use current "Revoke grant" action, > which will revoke both consents and offline tokens? Not sure what would be the difference there. The consent is linked to the client, while the offline token would be a session, right? If so, I'd revoke only the token itself. > - Admin can see the offline tokens for user in admin console and can > revoke them too . Current button "Logout All" in sessions tab will > revoke offline tokens from all users . For performance reasons, we may > need method on UserProvider, so it's possible to clean whole DB table > "OFFLINE_TOKEN" (similarly for mongo) instead of iterating through all > users. +1 > - For adapters, we should likely have an option, so the REST endpoint > adapter has possibility to validate offline token by always sending > validation request to KC server. We didn't need it for access tokens, > which are valid just for 1 minute or so, but offline tokens are long > lived so adapter should have this possibility IMO. +1 - Juca. _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev