We have 2 timeouts related to session:
- Idle timeout: it's 30 minutes by default. It is refreshed after
each token refresh or successful SSO login. In other words, in
your Javascript application, you need to perform token refresh at
least once per 30 minutes. The timeout is available on
refreshToken and can be checked in your JS application by
"keycloak.refreshTokenParsed.exp"
- Max session lifespan: It's 10 hours by default. This is really
maximum timeout of each session from login time. Even if you
refresh your token each 30 minutes, after 10 hours will be session
expired and your user would really need to get redirected to KC
login screen and re-authenticate. This is not available in JS app
afaik, but people still need to re-authenticate after this time,
so I think it's not an issue.
All timeouts are configurable. See
http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/timeouts.html
Marek
On 3.2.2015 10:59, Christoph Machnik wrote: