Hi all, I'm using keycloak 2.2.1 to secure my application. The application can be accessed both via web and mobile (Android app). Both of them use the authorization code flow, which I believe it's the ideal form of authentication for my case. The topic I want to clarify here is token lifespans. As far as I understand, the SSO session idle timeout determines how long can a token last without being refreshed. On the other hand, SSO session max determines how long can a token last, even if it's being refreshed once and again. Well, now couple of questions: 1. Is there a way to make the web session limited to, let's say, 30 minutes and to have a long lived refresh token for the app? 2. How to deal with the refresh token in the app? What I do right now is to launch a webview when application starts and store the access and refresh tokens in user preferences (which is secured in Android). I wrap each http request made from the app and add the access token, unless it has expired, then I request a new access token with the refresh token. But when should I check the validity for the refresh token itself? I don't want a chain of requests being interrupted because of the refresh token being expired! Thanks in advanced for your help!

Found the location of the "Offline Access" section: https://keycloak.gitbooks.io/server-adminstration-guide/ content/topics/sessions/offline.html On 11/16/2016 09:55 AM, Iván Perdomo wrote: > Hi, > > I think you should look at offline tokens, introduced in Keycloak 1.6.1 [1] > > [1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html > > On 11/15/2016 06:06 PM, Aritz Maeztu wrote: >> Hi all, >> >> I'm using keycloak 2.2.1 to secure my application. The application can >> be accessed both via web and mobile (Android app). Both of them use the >> authorization code flow, which I believe it's the ideal form of >> authentication for my case. >> >> The topic I want to clarify here is token lifespans. As far as I >> understand, the SSO session idle timeout determines how long can a token >> last without being refreshed. On the other hand, SSO session max >> determines how long can a token last, even if it's being refreshed once >> and again. Well, now couple of questions: >> >> 1. Is there a way to make the web session limited to, let's say, 30 >> minutes and to have a long lived refresh token for the app? >> >> 2. How to deal with the refresh token in the app? What I do right now is >> to launch a webview when application starts and store the access and >> refresh tokens in user preferences (which is secured in Android). I wrap >> each http request made from the app and add the access token, unless it >> has expired, then I request a new access token with the refresh token. >> But when should I check the validity for the refresh token itself? I >> don't want a chain of requests being interrupted because of the refresh >> token being expired! >> >> Thanks in advanced for your help! >> >> > -- Iván _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user