82

Keycloak refresh token lifetime is 1800 seconds:

"refresh_expires_in": 1800

How to specify different expiration time? In Keycloak admin UI, only access token lifespan can be specified:

enter image description here

dreamcrash
  • 47,137
  • 25
  • 94
  • 117
rok
  • 9,403
  • 17
  • 70
  • 126

4 Answers4

159

As pointed out in the comments by @Kuba Šimonovský the accepted answer is missing other important factors:

Actually, it is much much much more complicated.

TL;DR One can infer that the refresh token lifespan will be equal to the smallest value among (SSO Session Idle, Client Session Idle, SSO Session Max, and Client Session Max).

After having spent some time looking into this, and now looking back at this thread, I feel that the previous answers felt short to explain in detail what is going on (one might even argue that they are wrong actually).

Let us assume for now that we only have SSO Session Idle and SSO Session Max:

  • and SSO Session Max > SSO Session Idle in this case the refresh token lifetime is the same as SSO Session Idle. Why? because if the application is idle for SSO Session Idle time the user gets logout and that is why the refresh token is bound to that value. Whenever the application requests a new token, both the refresh token lifetime and SSO Session Idle countdown values will be reset again;
  • and SSO Session Max <= SSO Session Idle then the refresh token lifetime will be the same as SSO Session Max. Why? because regardless of what the user does (i.e., idle or not) the user gets logout after SSO Session Max time, and thus why the refresh token is bound to that value.

From here we conclude that the refresh token lifespan is bound to the lowest of the two values SSO Session Idle and SSO Session Max.

Both those values are related to Single Sign-ON (SSO). We still need to consider the values of the Client Session Idle and Client Session Max fields of the realm settings, which when NOT set are the same as SSO Session Idle and SSO Session Max, respectively.

If those values are set, in the context of the refresh token, they will override the values from SSO Session Idle and SSO Session Max, BUT only if they are lower than the values from SSO Session Idle and SSO Session Max.

Let us see the following examples: SSO Session Idle = 1800 seconds, SSO Session Max = 10 hours and:

  1. Client Session Idle = 600 seconds and Client Session Max = 1 hour. In this case, the refresh token lifespan is the same as Client Session Idle;
  2. Client Session Idle = 600 seconds and Client Session Max = 60 seconds. In this case, the refresh token lifespan is the same as Client Session Max.
  3. Client Session Idle = 1 day and Client Session Max = 10 Days. In this case, the refresh token lifespan is the same as SSO Session Idle;

So in short you can infer that refresh token lifespan will be equal to the smallest value between (SSO Session Idle, Client Session Idle, SSO Session Max, and Client Session Max).

So the claim from previous answers that you can simply use the Client Session Max to control the refresh token lifespan is FALSE. One just needs to look at the previous examples 1) and 3).

Finally, the fields Client Session Idle and Client Session Max from the realm settings can be overwritten by the Client Session Idle and Client Session Max in the clients themselves, which will affect the refresh token lifespan for that client in particular.

The same logic applies but instead of considering the values Client Session Idle and Client Session Max from the realm settings one needs to consider those from the client advance settings.

dreamcrash
  • 47,137
  • 25
  • 94
  • 117
  • tip: Point 3 should end in "…is the same as Client Session Idle;" because I understand your logic: it is the shortest of Client Session Idle vs Max :) – Arno Teigseth Jun 13 '23 at 14:11
  • @ArnoTeigseth No, it will actually be the smallest among the values SSO Session Idle, Client Session Idle, SSO Session Max, and Client Session Max. – dreamcrash Jun 13 '23 at 18:51
  • 1
    ahh ok I thought you referred to comparing only the two values "inside" of point 3. But I see now all 3 points are cases compared to the top text. Great answer! Currently looking into what seems to be a bug in Keycloak when setting very short values for Client Session Idle… – Arno Teigseth Jun 14 '23 at 22:46
52

The refresh token lifetime is controlled by the SSO Session Idle Setting. 30 minutes = 30 * 60 = 1800 seconds (the refresh_expires_in value)

Erik Tribou
  • 552
  • 6
  • 3
  • 38
    Actually, it is much much much more complicated. There are many relationships between each field and you can override it on 3 different places.. To make it clear, Keycloak is a hell. But for me, I had to set `Client Session Idle` to 0, `Client Session Max` to 0, `SSO Session Idle` to 999 Days. After that, I can control access token timeout with `Access Token Lifespan` and refresh token timeout with `SSO Session Max` . Took me 1 hour playing with all variables. `SSO Session Idle` or `Access Token Lifespan` will be taken whichever has lower amount of time – Kuba Šimonovský Sep 03 '20 at 13:44
  • @KubaŠimonovský the problem with setting the SSO Session Idle to 999 you lose the idle functionality basically – dreamcrash May 20 '21 at 16:16
  • @KubaŠimonovský I set `Client Session Idle` to 0, `Client Session Max` to 0 and `SSO Session Idle` to 12 hours, but still the idle session expires in 30 minutes only. What else is required? – Shashank Shekher Jun 22 '21 at 04:24
  • Thanks, @KubaŠimonovský this was helpful. – Jalaj Chawla Jul 30 '21 at 07:34
  • In the latest version, at the moment of writing 15.0.2, the refresh_expires_in value kept being 0. To fix this, I had to switch the Offline Session Max Limited toggle to "On". – Marty Dec 10 '21 at 11:38
5

In v11.0.3, under the advanced settings for the client, there are no SSO Session Idle settings (not sure if these have just been renamed, moved, or are a realm setting available elsewhere in the admin interface), so starting with default client settings, you can specify Client Session Max to control refresh token lifetime without needing to change the other duration settings (Access Token Lifetime continues as you would expect). Evidence: adjusting settings and checking refresh_expires in response.

hairycoo
  • 81
  • 1
  • 4
1

The refresh tokens lifespan is defined by the "Client Session Max" parameter in the "Tokens" tab of the Realm settings.

It can also be overridden on individual clients level under the "Advanced Settings" menu of the client settings page.

Like stated in the Keycloak docs: https://www.keycloak.org/docs/latest/server_admin/#_timeouts

Client Session Max

The maximum time before a refresh token is expired and invalidated. It allows for the specification of a shorter timeout of refresh token than session timeout. And it can be overridden on individual clients. It is an optional configuration and if not set to a value bigger than 0 it uses the same idle timeout set in the SSO Session Max configuration.

Jems
  • 11
  • 2