Control users status (connected/disconnected) in my Spring-Boot App with Keycloak

user_18570428 0
Viewed 52

I have a user-management REST application (Spring-Boot) integrated with Keycloak, and I would like to know if there is any way to see the status (connected or disconnected) of my clients.

I have in mind is to create a table in my database with an user-identifier and a boolean, and each time have Front make login, update the boolean to true, and when logging-out update the boolean to false.

But I have a problem with sessions. If a user does not log-out (the application is left open in the background), but the token expires, how can I control this?

Is there a simpler way to control user states?

keycloak spring-boot status rest java
1 Answers

I suspect your issue to be related to your client not using refresh-token to renew access-token before it expires. Serious client libs do so.

Frequently, OpenID resource-servers are session-less: user state from JWT access-token only.

You can have a look at those tutorials which setup various spring-boot resource servers: https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials

If user is "disconnected" client should send request without authorization header (or invalid token) and spring security context will be populated with AnonymousAuthenticationToken (if anonymous was enabled in your conf) => access will only be allowed if request path is configured with permitAll().

If user is connected, client OpenID lib should maintain valid access-token (with the help of refresh-token).

user_6198300
Related