Repository navigation
CIBA Authentication Request requested_expiry handling
#50586
maxplumley
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi folks, I've noticed that Keycloak appears to ignore the parameter
requested_expiryprovided to CIBA's Backchannel Auth endpoint (details here), instead settingexpires_into whatever is configured by the administrator.I operate Keycloak in an environment where some clients require a significantly longer TTL than others, honoring the
requested_expirywould help to support these clients without inflating the TTL for all clients.Some high-level goals:
requested_expiryto influence theexpires_inset by Keycloak.expires_infor requests without a providedrequested_expiry), and retain the existing 'maximum' TTL (Authentication > CIBA Policy > Expires In in administrator UI) to enforce an upper limit on whatrequested_expirycan be provided by a client.requested_expiry) where a 'default' TTL has not been set by the administrator.Happy to work on this one if it's considered worthwhile :).
All reactions