Re: [keycloak-user] can't use refresh token with keycloak-gatekeeper

Hi, I've encountered a similar issue and haven't been able to get the token refresh to work. I've also tried using a persistent boltdb store too without much luck. My current configuration is the following (discovery url etc. are configured in the yaml config): - --config=/tmp/service.yaml - --enable-refresh-tokens - --enable-encrypted-token - --enable-logging=true - --enable-security-filter=true - --verbose Here's an excerpt of my logs: 1.5428809565823147e+09 debug keycloak-gatekeeper/middleware.go:337 access permitted to resource {"access": "permitted", "email": &quot;christian.fraenkel(a)actico.com&quot;, "expires": 29.417686616, "resource": "/api/console/*"} 1.5428809566050725e+09 info keycloak-gatekeeper/middleware.go:90 client request {"latency": 0.025043756, "status": 200, "bytes": 0, "client_ip": "192.168.201.89:43778", "method": "POST", "path": "/api/console/proxy"} 1.5428810165834415e+09 debug keycloak-gatekeeper/session.go:51 found the user identity {"id": "b841a9ec-04e6-4284-9eeb-0999d9748900", "name": "chrfra01", "email": &quot;christian.fraenkel(a)actico.com&quot;, "roles": "offline_access,uma_authorization,employee,test:user,kibana:user,account:manage-account,account:manage-account-links,account:view-profile"} 1.5428810165833974e+09 info keycloak-gatekeeper/middleware.go:154 accces token for user has expired, attemping to refresh the token {"client_ip": "192.168.201.89:44036", "email": &quot;christian.fraenkel(a)actico.com&quot;} 1.5428810168737714e+09 info keycloak-gatekeeper/middleware.go:190 injecting the refreshed access token cookie {"client_ip": "192.168.201.89:44036", "cookie_name": "kc-access", "email": &quot;christian.fraenkel(a)actico.com&quot;, "expires_in": 299.126230477} 1.5428810168739688e+09 debug keycloak-gatekeeper/middleware.go:337 access permitted to resource {"access": "permitted", "email": &quot;christian.fraenkel(a)actico.com&quot;, "expires": -30.873967499, "resource": "/api/console/*"} 1.5428810168941607e+09 info keycloak-gatekeeper/middleware.go:90 client request {"latency": 0.311326585, "status": 200, "bytes": 0, "client_ip": "192.168.201.89:44036", "method": "POST", "path": "/api/console/proxy"} Once the expiration goes negative each request results in a new "injecting the refreshed access token cookie" line. Once enough time has passed (expiery > 1500 in my case) I get the following message: 1.5428825166849744e+09 warn keycloak-gatekeeper/middleware.go:175 refresh token has expired, cannot retrieve access token {"client_ip": "192.168.201.89:51046", "email": &quot;christian.fraenkel(a)actico.com&quot;} After this line access is no longer possible and I get redirected to the login screen. I've also found the following comment on a github commit where somebody else is encountering issues with refresh tokens: https://github.com/keycloak/keycloak-gatekeeper/commit/0bb1c03b03c574542b... It would be nice to get the refresh token switch working. I'm also looking for solutions / input on this. Regards, Christian -----Ursprüngliche Nachricht----- Von: keycloak-user-bounces(a)lists.jboss.org <keycloak-user-bounces(a)lists.jboss.org&gt; Im Auftrag von Andrey Kozichev Gesendet: Mittwoch, 21. November 2018 01:01 An: keycloak-user(a)lists.jboss.org Betreff: [keycloak-user] can't use refresh token with keycloak-gatekeeper Hello! has anyone come across use of refresh tokens with keyckloak-gatekeeper? I've got a Web app running behind keycloak-gatekeeper. Currently session expires after 5 minutes of inactivity. In the logs I see "session expired and access token refreshing is disabled". To avoid this, I am trying to enable "refresh tokens" on my gatekeeper proxy by adding "*--enable-refresh-tokens=true"* , the full list of configuration options: - --client-id=my_clientid - --discovery-url=<keycloak_url> - --enable-default-deny=false - --enable-json-logging=true - --enable-logging=true - --enable-request-id=true - --enable-encrypted-token=true - --encryption-key=<secret> * - --enable-refresh-tokens=true* - --enable-security-filter=true - --listen=0.0.0.0:8080 - --preserve-host=true - --redirection-url=http://my-public-url - --resources=uri=/*|roles=user-role - --upstream-url=myservice.svc.cluster.local:8080 However after adding "*enable-refresh-tokens=true*" - I get 502 when trying to login. In the Gatekeeper logs I see below lines. Has anyone came across this? I must be missing something obvious. {"level":"info","ts":1542757702.835068,"msg":"issuing access token for user","email":"myemail@gmail.com ","expires":"2018-11-20T23:53:22Z","duration":"4m59.164934314s"} {"level":"info","ts":1542757702.8363702,"msg":"client request","latency":0.05726285,"status":307,"bytes":37,"client_ip":" 10.44.1.32:60746","method":"GET","path":"/oauth/callback"} *{"level":"error","ts":1542757702.8891447,"msg":"no session found in request, redirecting for authorization","error":"authentication session not found"}* {"level":"info","ts":1542757702.8892436,"msg":"client request","latency":0.000152955,"status":307,"bytes":75,"client_ip":" 10.44.1.32:60752","method":"GET","path":"/favicon.ico"} {"level":"info","ts":1542757703.03116,"msg":"client request","latency":0.001002773,"status":307,"bytes":319,"client_ip":" 10.44.1.32:60754","method":"GET","path":"/oauth/authorize"} {"level":"info","ts":1542757703.108161,"msg":"issuing access token for user","email":"myemail@gmail.com ","expires":"2018-11-20T23:53:23Z","duration":"4m59.891841634s"} {"level":"info","ts":1542757703.109042,"msg":"client request","latency":0.021427778,"status":307,"bytes":48,"client_ip":" 10.44.1.32:60758","method":"GET","path":"/oauth/callback"} Regards, Andrey _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user