3

I am very new to keycloak and want to use it for SSO, but some of our apps want to have different session expiration length, say App A is 4 hours, App B is 8 hours.

To make this work, I will need to set the keycloak to the shortest expiration time, in this case is 4 hours.

Is this the only way? Or by a long shot, keycloak can treat each client differently?

eg.

Keycloak session set to 16 hours, if request from App A, it will force user to login?

https://keycloak/oicd/login/?client_id=app_a&....
James Lin
  • 25,028
  • 36
  • 133
  • 233

1 Answers1

1

It is not clear what session means in your case. User is logged, when app has valid id/access token, which is usually short lived, e.g. 5 min and app refreshes/renews tokens periodically (for example with refresh tokens). In theory that refresh can be running indefinitely, but actually Offline Session timeouts are applied for refresh token, so it can be limited.

There is also IdP SSO session on top of that, which mean that user/app will get token without asking for user credential, when user is redirected to the IdP login page = user was authenticated recently and it still has that SSO session.

Anyway, Keycloak gives you option to customize session/token timeouts on the realm level: Keycloak timeout realm configuration

Some of those timeouts can be overwritten also on the client level: Keycloak timeout client configuration

Note: there can be many dependencies, between all those timeouts, so always test your setup to see how it fits your needs. Example, how it can be complicated: How to specify refresh tokens lifespan in Keycloak

Jan Garaj
  • 25,598
  • 3
  • 38
  • 59
  • 1
    the SSO session is the point I am asking, is there a way to force a specific client to login even there is an SSO session? – James Lin Nov 09 '20 at 19:46
  • 3
    @JamesLin that's not possible. Clients from the same realm share the same SSO session, so any different SSO session timeouts will be fighting each other if they will be configurable on the client level. So may have those clients in different realms with different SSO session timeout, but that sounds like overkill. – Jan Garaj Nov 09 '20 at 22:59
  • Jan is absolutely right. You should reconsider your requirements. Also see https://stackoverflow.com/questions/63723631/different-idle-times-for-clients-keycloak/63724138#63724138 – solveMe Nov 10 '20 at 11:03