On 24/02/16 12:45, Satyajit Das wrote:

Hi Marek,

We cant have access token so short lived because users can login and do operations and can stay logged in for some time.

In that case, you can do refreshing tokens after some period. Basically before you send request to REST service, you will check if your accessToken is still valid (you can parse it and see expiration period). If it is outdated, you will send request to Keycloak to refresh the access token. That's how our adapters work. If you use adapter, you can be logged to application for a long time even if accessToken lifespan is just 1 minute.

If you really can't rely on short access token, there is possibility that your REST service will always send request to Keycloak to doublecheck if access token is still valid. We have support for Token introspection ( https://tools.ietf.org/html/rfc7662 ). The endpoint should be under http://localhost:8080/auth/realms/YourREALMName/protocol/openid-connect/token/introspect . Note that this has performance impact as REST service will always need to contact Keycloak to doublecheck token.

Marek

What we are relying is that once the logout url is called using refresh token id. The user when tries to access a webservice using the token should not be allowed to as the logout service has been called.

But the user can get the data, using the old token. Any suggesstion how to stop this behaiviour.

Regards,

Satya.
On Wed, Feb 24, 2016 at 4:39 PM, Marek Posolda <mposolda@redhat.com> wrote:
On 24/02/16 10:58, Satyajit Das wrote:

Hi Team we are facing the below issue with logout.

i use login/logout restful service:

after login

i get tokenid say "t1" and refreshtokenid say "rt1"

1) We have registered a webservice as a keycloak client (example demo123) with access type as bearer.

2) When I call the logout rest service:

if (isPublic()) { // if client is public access type formparams.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "demo123")); }

URI logoutUri = KeycloakUriBuilder.fromUri(getBaseUrl(request) + "/auth") .path(ServiceUrlConstants.TOKEN_SERVICE_LOGOUT_PATH) .build("RealmName");

the logout gives 204 for client's access type as open.

but when i again hit the service with the token id "t1" after logout.

Still i can get the response. Note this response doesnt hit keycloak.

Yes, it works this way and that's why we suggest to use short lifetimes for accessToken (1 minute). This means that access token needs to be refreshed every 1 minute and the request for refreshing token actually needs to hit Keycloak server (in your case, refresh won't success because you already did logout).

Marek
Regards,

Satya
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user