Disable Keycloak user ASAP when account is disabled on identity provider

Configuring the server
1

When an user account is disabled on a connected IdP, how do I ensure the account is blocked as soon as possible on Keycloak? At the moment, the “disabled” user is able to continue using my SPA because Keycloak continues to refresh the access token without speaking to the external IdP.

One of the critical features required by my partners when using SSO is that they have control over their users’ access to my application. At the moment if the user was logged into my SPA, they can continue using it for about 24 hours. I would hope to cut that time down to 5 minutes, the lifetime of the access token.

The external IdP is Google. I have tried using both Keycloak’s builtin Social provider for Google as well as setting up a SAML app in Google and user-defind SAML provider in Keycloak. I’m using Keycloak v9 but can upgrade if necessary.

Is there a recipe to achieve my goal? What options do I need to set in the Keycloak client and SAML provider?

Many thanks!

1 Like
2

Probably the limited option is to reduce session on Keycloak and the SP – in order that a check is done on user’s session or re-authentication on the IDP (where if disabled, would action appropriately).

3

The approach could be as follows. The resource server will need to do the checking with the IDP, not Keycloak.

  1. Enable the option to Store Tokens and Read Stored Tokens in the IDP settings.
  2. Assign users the broker/read-tokens role.
  3. On the resource server, decide on a frequency to check whether the user has been disabled on the IDP. Be aware of each IDP’s token introspection’s endpoint. Each time the API is consumed:
    1. First of course verify the access token as usual.
    2. If it’s time to verify against the IDP, call the Keycloak API with the access token to retrieve the IDP’s access token.
      • The Keycloak endpoint is: https://{domain}/realms/{realm}/broker/{idpid}/token
    3. Call the IDP’s token introspection endpoint to validate the IDP access token.
    4. Act accordingly if the IDP responds that the token is not valid. Respond with 401 and ensure that the Keycloak access token can’t be used again. Maybe the end_session_endpoint or revocation_endpoint, not sure.

Token validation endpoints: