Repository navigation
|
Hello, I want to clarify what the expected behaviour is in the following use case: I have an application that uses Keycloak for its authentication. In that Keycloak, I have configured another external Keycloak as Identity Provider via "Keycloak OpenID Connect". Now I do login with a user from the external Keycloak (via OpenID Connect). In both Keycloaks I can configure several SSO values such as session idle time, session max time etc. Which values will be used? How and when does our internal Keycloak verify that the maximum session time from the external Keycloak are not exceeded? Cheers |
Replies: 1 comment
|
Both Keycloaks each have a session for the user and the sessions are completely independent and can be configured independently. In general, it makes sense to configure longer session durations on the external IDP and possibly also longer SSO Idle Timeouts, so the session on the external IDP stays alive long enough for a logout to work correctly (the external IDP cannot redirect back if its session is already expired). |
Both Keycloaks each have a session for the user and the sessions are completely independent and can be configured independently. In general, it makes sense to configure longer session durations on the external IDP and possibly also longer SSO Idle Timeouts, so the session on the external IDP stays alive long enough for a logout to work correctly (the external IDP cannot redirect back if its session is already expired).