On 24/02/16 10:58, Satyajit Das wrote:

Hi Team we are facing the below issue with logout.

i use login/logout restful service:

after login

i get tokenid say "t1" and refreshtokenid say "rt1"

1) We have registered a webservice as a keycloak client (example demo123) with access type as bearer.

2) When I call the logout rest service:

if (isPublic()) { // if client is public access type formparams.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "demo123")); } 

URI logoutUri = KeycloakUriBuilder.fromUri(getBaseUrl(request) + "/auth") .path(ServiceUrlConstants.TOKEN_SERVICE_LOGOUT_PATH) .build("RealmName");

the logout gives 204 for client's access type as open.

but when i again hit the service with the token id "t1" after logout.

Still i can get the response. Note this response doesnt hit keycloak.

Yes, it works this way and that's why we suggest to use short lifetimes for accessToken (1 minute). This means that access token needs to be refreshed every 1 minute and the request for refreshing token actually needs to hit Keycloak server (in your case, refresh won't success because you already did logout).

Marek

Regards,

Satya

_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user