Keycloak issues already expired Refresh Tokens if Client Session Max is set < KC SSO Session

Configuring the server
1

Hi,

We have a Realm setting for KC session for say 10 days.
We can set, at the client level, Client Session Max to a lower value, for ex 1 day.

In this case, we can encouter the following case : user still has a valid KC session, but when requesting a refresh token, KC issues an already expired token.

Is this normal ? Are there best practices (for ex, Client Session Max should never be < to KC Session ?).

What are the uses cases where setting the Client Session Max at the client level would help if it leads to already expired tokens ?

Thanks

1 Like