Am using keyclock as an authorization manager. If logged in as user (user1) and try to login again after 1 day it will redirect to login page (SSO fails) when enter new user credentials(user2) its shows You are already authenticated as different user '0000000021' in this session. Please sign out first. But when inspecting the browser keeps these 2 sessions and all others are sessions missing. When we manually deleting all session except AUTH session the issue can be regenerated. I don't know how its happening in real scenario.
this is the error showing
when walk through keyclock code I see this.
if (!authSession.getAuthenticatedUser().equals(userSession.getUser())) {
event.detail(Details.EXISTING_USER, userSession.getUser().getId());
event.error(Errors.DIFFERENT_USER_AUTHENTICATED);
throw new ErrorPageException(session, authSession, Response.Status.INTERNAL_SERVER_ERROR, Messages.DIFFERENT_USER_AUTHENTICATED, userSession.getUser().getUsername());
}
but I don't know when the Auth session keep alive and SSO session miss.
my token configuration is
