Keycloak Session and Token Timeout: Client login timeout
We are currently verifying our Keycloak Session and Token timeout settings to rule out error potential. I think default configuration should do it for our use case.
I think the only worrying value is "Client login timeout" which we've set to 1 minute (like in the screenshot of the documentation).
Documentation here states: Client login is the maximum time that a client has to finish the Authorization Code Flow in OIDC.
I read it but I don't understand it... I guess the documentation copy pasted this from redhat documentation here (or vice versa) but also there is no detailed explanation there.
So my question really is: What is "client login timeout" and what would be a good default for it? A perfect answer for me would just describe the workflow from a user perspective when it fails (like user drank a coffee for 1 minute before clicking the e-mail verification link etc.) and/or a link to further reading
keycloak session-timeout
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
add a comment |
We are currently verifying our Keycloak Session and Token timeout settings to rule out error potential. I think default configuration should do it for our use case.
I think the only worrying value is "Client login timeout" which we've set to 1 minute (like in the screenshot of the documentation).
Documentation here states: Client login is the maximum time that a client has to finish the Authorization Code Flow in OIDC.
I read it but I don't understand it... I guess the documentation copy pasted this from redhat documentation here (or vice versa) but also there is no detailed explanation there.
So my question really is: What is "client login timeout" and what would be a good default for it? A perfect answer for me would just describe the workflow from a user perspective when it fails (like user drank a coffee for 1 minute before clicking the e-mail verification link etc.) and/or a link to further reading
keycloak session-timeout
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
add a comment |
We are currently verifying our Keycloak Session and Token timeout settings to rule out error potential. I think default configuration should do it for our use case.
I think the only worrying value is "Client login timeout" which we've set to 1 minute (like in the screenshot of the documentation).
Documentation here states: Client login is the maximum time that a client has to finish the Authorization Code Flow in OIDC.
I read it but I don't understand it... I guess the documentation copy pasted this from redhat documentation here (or vice versa) but also there is no detailed explanation there.
So my question really is: What is "client login timeout" and what would be a good default for it? A perfect answer for me would just describe the workflow from a user perspective when it fails (like user drank a coffee for 1 minute before clicking the e-mail verification link etc.) and/or a link to further reading
keycloak session-timeout
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
We are currently verifying our Keycloak Session and Token timeout settings to rule out error potential. I think default configuration should do it for our use case.
I think the only worrying value is "Client login timeout" which we've set to 1 minute (like in the screenshot of the documentation).
Documentation here states: Client login is the maximum time that a client has to finish the Authorization Code Flow in OIDC.
I read it but I don't understand it... I guess the documentation copy pasted this from redhat documentation here (or vice versa) but also there is no detailed explanation there.
So my question really is: What is "client login timeout" and what would be a good default for it? A perfect answer for me would just describe the workflow from a user perspective when it fails (like user drank a coffee for 1 minute before clicking the e-mail verification link etc.) and/or a link to further reading
keycloak session-timeout
keycloak session-timeout
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
edited Nov 19 '18 at 14:06
CodingYourLife
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
asked Nov 19 '18 at 13:58
CodingYourLifeCodingYourLife
1,31131632
1,31131632
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
In simply terms it is time spent by client to get Access Token.
It is the maximum time client has to finish Authorization Code Flow. The steps involved in Authorization Code Flow can be found in OIDC specs.
https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps
- Client prepares an Authentication Request containing the desired request parameters.
- Client sends the request to the Authorization Server.
- Authorization Server Authenticates the End-User.
- Authorization Server obtains End-User Consent/Authorization.
- Authorization Server sends the End-User back to the Client with an Authorization Code.
- Client requests a response using the Authorization Code at the Token Endpoint.
- Client receives a response that contains an ID Token and Access Token in the response body.
- Client validates the ID token and retrieves the End-User's Subject Identifier.
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53376229%2fkeycloak-session-and-token-timeout-client-login-timeout%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
In simply terms it is time spent by client to get Access Token.
It is the maximum time client has to finish Authorization Code Flow. The steps involved in Authorization Code Flow can be found in OIDC specs.
https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps
- Client prepares an Authentication Request containing the desired request parameters.
- Client sends the request to the Authorization Server.
- Authorization Server Authenticates the End-User.
- Authorization Server obtains End-User Consent/Authorization.
- Authorization Server sends the End-User back to the Client with an Authorization Code.
- Client requests a response using the Authorization Code at the Token Endpoint.
- Client receives a response that contains an ID Token and Access Token in the response body.
- Client validates the ID token and retrieves the End-User's Subject Identifier.
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
add a comment |
In simply terms it is time spent by client to get Access Token.
It is the maximum time client has to finish Authorization Code Flow. The steps involved in Authorization Code Flow can be found in OIDC specs.
https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps
- Client prepares an Authentication Request containing the desired request parameters.
- Client sends the request to the Authorization Server.
- Authorization Server Authenticates the End-User.
- Authorization Server obtains End-User Consent/Authorization.
- Authorization Server sends the End-User back to the Client with an Authorization Code.
- Client requests a response using the Authorization Code at the Token Endpoint.
- Client receives a response that contains an ID Token and Access Token in the response body.
- Client validates the ID token and retrieves the End-User's Subject Identifier.
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
add a comment |
In simply terms it is time spent by client to get Access Token.
It is the maximum time client has to finish Authorization Code Flow. The steps involved in Authorization Code Flow can be found in OIDC specs.
https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps
- Client prepares an Authentication Request containing the desired request parameters.
- Client sends the request to the Authorization Server.
- Authorization Server Authenticates the End-User.
- Authorization Server obtains End-User Consent/Authorization.
- Authorization Server sends the End-User back to the Client with an Authorization Code.
- Client requests a response using the Authorization Code at the Token Endpoint.
- Client receives a response that contains an ID Token and Access Token in the response body.
- Client validates the ID token and retrieves the End-User's Subject Identifier.
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
In simply terms it is time spent by client to get Access Token.
It is the maximum time client has to finish Authorization Code Flow. The steps involved in Authorization Code Flow can be found in OIDC specs.
https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps
- Client prepares an Authentication Request containing the desired request parameters.
- Client sends the request to the Authorization Server.
- Authorization Server Authenticates the End-User.
- Authorization Server obtains End-User Consent/Authorization.
- Authorization Server sends the End-User back to the Client with an Authorization Code.
- Client requests a response using the Authorization Code at the Token Endpoint.
- Client receives a response that contains an ID Token and Access Token in the response body.
- Client validates the ID token and retrieves the End-User's Subject Identifier.
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
answered Nov 19 '18 at 23:54
ravthiruravthiru
3,60212131
3,60212131
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53376229%2fkeycloak-session-and-token-timeout-client-login-timeout%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
