Shouldn't Keycloak reject auth-cookie after SSO idle timeout?

1

I was expecting that a request to the OIDC auth endpoint containing the Keycloak Auth cookies, which was received after the SSO idle timeout, would not be automatically authenticated. But this seems to be the case.

Here’s our setup:

Here’s our scenario:

  • User requests webapp
  • oauth2-proxy intercepts request, performs OAuth code flow, stores access and ID tokens and issues a session cookie to user agent
  • oauth2-proxy is configured to refresh tokens every minute.
  • Keycloak is configured with SSO idle timeout of 2 minutes.
  • After idle timeout of >2 Minutes, user requests webapp’s resources again
  • oauth-proxy tries to refresh token at Keycloak token endpoint, but doesn’t succeed (correctly, since idle timeout has passed and session is therefore invalid)
  • oauth-proxy redirects call to Keycloak auth endpoint
  • Keycloak now doesn’t respond with login page, but redirects directly to app’s /callback-endpoint with a valid auth code.
  • Keycloak (DEBUG) logs show:
    • […] invoke authenticator.authenticate: auth-cookie
    • […] authenticator SUCCESS: auth-cookie

Is this intended behaviour?

I was under the impression that after the SSO timeout has passed, the user would be required to log in again via the login form.

2

Hallo!

I have the same issue. I did you solve it?

3

There are two types of sessions on the Keycloak side after the user logs in:

  • A global SSO session
  • And for each client application, a session is created.

In the Keycloak admin console, you can set an idle session timeout for both clients and SSO sessions (found under realm settings > sessions tab). Additionally, you can specify a custom idle session timeout for each client in its configuration (under the advanced tab), which will take precedence over the global value if it’s inferior than the global one.

Also when a client session expires, it doesn’t affect the global SSO session, and the user will not be forced to login again.

Could you please provide the configured value for both settings at the realm and client level ? (Client and SSO session).

4

Also, how did you manage to achieve this ? OAuth2-proxy doesn’t proactively refresh the sessions ( see more here).