[keycloak-user] What the URI of the Refresh Token HTTP request for Java Adapters?

Fri Dec 16 09:20:50 EST 2016

Thanks Sebastien,

Can you clarify what you mean the session of the cookie?
I want to configire for all clients 30 minutes session timeout.
Same timeout for the session cookie on IDP.

Still not clear to me if a user will work 2 hours on the first  client and then will access to the second client how the session on the second cliend still active.

May be the session on the second client already not active but the second client redirects to IDP and see that the IDP token is valid and then it redirects back with the token to the second client without an authentication.

Correct?

On Dec 16, 2016 3:48 PM, Sebastien Blanc <sblanc at redhat.com> wrote:

On Fri, Dec 16, 2016 at 1:02 PM, Michael Furman <michael_furman at hotmail.com<mailto:michael_furman at hotmail.com>> wrote:

Hi Sebastien,

Thank you for your help!

I need to clarify my questions.

According to my understanding Keycloak handles the full SSO.

For example I have 2 OIDC clients (SpringSecurity adapters) that work with the same IDP.

(The client are not bearer-only clients)

When a user works (performs HTTP requests) on the first OIDC client the token on the second OIDC client should be refreshed.
Otherwise when the user will access the second client it will not be able to work.

Therefore I think that Keycloak IDP send some request to the second OIDC client to refresh the token.

Is it correct?

no

If yes – what request IDP sends to the second OIDC client to refresh its token?

If not – how Keycloak allows to access to the second OIDC client after the user works on the first OIDC client for a long time?

For SSO, it will use the session or the cookie (depending how you configure it), no extra request are made for the second client.

One additional question about the logout:

If a user will execute http://<ip>/<app>/sso/logout<http://%3cip%3e/%3capp%3e/sso/logout> on the first OIDC client I think that the token on the second OIDC client becomes invalid and also the Keycloak session becomes invalid.

yeah the session will be removed so all the clients will be logout.

This is my understanding of the implementation of Single Logout by Keycloak.

Will happy for the confirmation.

Best regards,

   Michael

________________________________
From: Sebastien Blanc <sblanc at redhat.com<mailto:sblanc at redhat.com>>
Sent: Friday, December 16, 2016 1:20 PM
To: Michael Furman
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

Subject: Re: [keycloak-user] What the URI of the Refresh Token HTTP request for Java Adapters?

Not really sure what you are asking for ... To refresh it's this type of url : <your_realm_url>/protocol/openid-connect/token?grant_type+refresh_token&refresh_token=<your_refresh_token>

And I don't understand your additonal question but maybe related to that, a bearer-only client won't have a refresh token.

On Fri, Dec 16, 2016 at 12:03 PM, Michael Furman <michael_furman at hotmail.com<mailto:michael_furman at hotmail.com>> wrote:
Hi all,

Will be happy for help.

I have tried to search but without success.

Can not find details here:

https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/sso-protocols/oidc.html

Best regards,

   Michael

________________________________
From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>> on behalf of Michael Furman <michael_furman at hotmail.com<mailto:michael_furman at hotmail.com>>
Sent: Thursday, December 15, 2016 10:08 PM
To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] What the URI of the Refresh Token HTTP request for Java Adapters?

Hi,
Additional question: according to my understanding in case a user works (performs http requests) on some client the Refresh Token HTTP request comes to other OIDC clients.

In case a user does not work on any client the Refresh Token HTTP request does not appear at all.

Will happy for the confirmation.
Michael

On Dec 15, 2016 7:26 PM, Michael Furman <michael_furman at hotmail.com<mailto:michael_furman at hotmail.com>> wrote:

Hi,
We use the SpringSecurity adapter.
I need to handle some internal application logic when the URI of the Refresh Token HTTP request comes to the adapter.
Can you tell me the URI of the Refresh Token HTTP request for Java Adapters?
Best regards,
   Michael

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
keycloak-user Info Page - JBoss Developer<https://lists.jboss.org/mailman/listinfo/keycloak-user>
lists.jboss.org<http://lists.jboss.org>
To see the collection of prior postings to the list, visit the keycloak-user Archives. Using keycloak-user: To post a message to all the list members ...

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user