Well ok, obviously I have not searched deep enough, there is already a Jira for this: https://issues.jboss.org/browse/KEYCLOAK-4521 br Marc Am 02.05.17, 14:43 schrieb &quot;keycloak-user-bounces(a)lists.jboss.org im Auftrag von Heide, Marc" <keycloak-user-bounces(a)lists.jboss.org im Auftrag von heide(a)365farmnet.com&gt;: Hi, We try to use Keycloak with offline tokens for end users, but in contradiction to https://lists.jboss.org/pipermail/keycloak-user/2017-January/009096.html where the Admin API is requested, we try to access the UserInfo enpoint. As soon as the user session died, which has created the offline token, the UserInfo endpoint returns a 401 with: { "error": "invalid_request", "error_description": "User session not found" } By looking at https://issues.jboss.org/browse/KEYCLOAK-4201 and https://issues.jboss.org/browse/KEYCLOAK-4371 and without really knowing the internals, but could it be the same problem here in the UserInfoEndpoint class line 142 ? It obviously does not consider offline sessions at all. Is that a wanted behavior? According to the OIDC spec the UserInfo endpoint should be usable with a valid offline access token even if the user session has been ended. (http://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess) Best Regards Marc _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user