Understanding Access token expiration when using client_credentials grant type

user_17327570 0
Viewed 69

we are using KeyCloak (version 16.0.0) as our IAM.

in our code, we are using the Admin Rest Api to handle user login.

in the first login, we are sending the user credentials and using the password grant type to get a valid access token.

but after that, whenever the access token is about to be expired (in our case 5 minutes) we are using the client_credentials grant type to generate a new access token.

I'm not an expert but it seems to me, that unlike working with refresh tokens, this way to generate a new access token can last forever and it's not bound by any value from KC configuration. Am I right?

I tried to play around with SSO Session Idle/Max and Client Session Idle/Max values (both on realm and client level) but it seems to have no impact.

any insight will be helpful

keycloak
1 Answers

I'm not an expert but it seems to me, that unlike working with refresh tokens, this way to generate a new access token can last forever and it's not bound by any value from KC configuration. Am I right?

What happens if the account of user A gets compromised? According, to your current setup you would keep that user logged in "forever", unless you would "tell" Keycloak to not omitted tokens on behalf of the client that is being used with the client_credentials grant type. But then other unrelated users would suffer. There is additional issues with this design, for example the assignment of roles to users, how would you handle user specify roles in the access token omitted by the client that is being used with the client_credentials grant type?

This seams to me to be a poor man's version of the refresh token mechanism.

in the first login, we are sending the user credentials and using the password grant type to get a valid access token.

If possible you should use more modern workflows for user login, like for example Authorization Code Flow (i.e., standard flow in Keycloak). Otherwise, just use the direct access grants with a short access token lifespan and renew it using the refresh token mechanism.

user_13668710
Related