Repository navigation
How to remove current user session in Authenticator SPI ? #24006
Unanswered
mcarbonneaux
asked this question in
Q&A
Replies: 3 comments
|
I just ran into a scenario where I need to do exactly this. Assigning a new user to the context without getting the error saying that you're already authenticated as another user. If there is an existing user session it can be found from the parent session id + realm. Then you can just delete it and then assign a new user to the context. @Override
public void authenticate(AuthenticationFlowContext context) {
RealmModel realm = context.getRealm();
KeycloakSession session = context.getSession();
String parentSessionId = context.getAuthenticationSession().getParentSession().getId();
UserSessionModel userSession = session.sessions().getUserSession(realm, parentSessionId);
if(Objects.nonNull(userSession)) {
session.sessions().removeUserSession(realm, userSession);
}
...
context.setUser(someNewUser);
} |
0 replies
|
Additionally, if the solution provided above doesn't work for you, you can invalidate session by setting last session refresh timestamp to 0 |
0 replies
|
and : AuthenticationManager.AuthResult authResult = AuthenticationManager.authenticateIdentityCookie(context.getSession(), context.getRealm(), true);
if (authResult != null && !authResult.getUser().getUsername().equals(myNewUser)) {
LOG.info("Logging out different user session: " + authResult.getUser().getUsername());
AuthenticationManager.backchannelLogout(context.getSession(), authResult.getSession(), true);
AuthenticationManager.expireIdentityCookie(context.getSession());
} |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
How to remove current user session in Authenticator SPI, to force logout ?
All reactions