In Keycloak 19.0.3, Refresh token got rejected with Invalid_grant and Offline user session not found #17396

VigneshKannaM · 2023-03-02T08:05:37Z

VigneshKannaM
Mar 2, 2023

As i am using Keycloak 19.0.3 version as identity broker,

Refresh token got rejected with "Invalid_grant and Offline user session not found", even within the time out limit configured in the Realm's tokens configuration,

Let's say I have configured timeout for refresh token as 15 days in the SSO Session Idle , SSO Session Max Offline Session Idle in my keyclaok identity provider. But token got expired before 15 days.

Note: Here IDP have configuration for refresh token session time out by 1 day and i am using OpenIDConnect protocol for IDP

Questions:

In case of Identity broker + Identity Provider setup, user session will be maintained by whom broker or Provider?
Access / refresh token's will be generated by identity broker or by Identity Provider ?
Do we need to sync the time out configurations between identity broker and Identity Provider ?

Please address my above questions,

Navigation Menu

Repository navigation

In Keycloak 19.0.3, Refresh token got rejected with Invalid_grant and Offline user session not found #17396

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

In Keycloak 19.0.3, Refresh token got rejected with Invalid_grant and Offline user session not found #17396

Uh oh!

Uh oh!

VigneshKannaM Mar 2, 2023

Replies: 0 comments

VigneshKannaM
Mar 2, 2023