Managing Tokens and Sessions

In addition to acting as a centralized authentication and authorization service, Keycloak is, at its core, a session and token management system.

As part of the authentication process, Keycloak may create server-side sessions and correlate them with tokens. By relying on these sessions, Keycloak is able to keep the state of the authentication context where sessions originated, track users’ and clients’ activity, check the validity of tokens, and decide when users and clients should re-authenticate.

In this chapter, we are going to look at how Keycloak allows you to manage tokens and their underlying sessions, as well as understanding the different aspects that you should be aware of when doing so. For that, we are going to cover the following topics:

• Managing sessions
• Managing tokens

Technical requirements

During this chapter, you are going to use the Keycloak administration console to follow some of the examples provided herein; therefore, make sure you have Keycloak up and running as per what you learned from Chapter 1, Getting Started with Keycloak.

Managing sessions

Session management has a direct impact on some key aspects such as user experience, security, high availability, and performance.

From a user experience perspective, Keycloak relies on sessions to determine whether users and clients are authenticated, for how long they should be authenticated, and when it is time to re-authenticate them. This characteristic of sessions is basically what gives users the single sign-on (SSO) experience when authenticating to different clients within the same realm, and what makes a unified authentication experience possible.

From a security perspective, sessions provide a security layer for tracking and controlling user activity and making sure that tokens issued to clients are still valid passports to act on behalf of users. They are also important for limiting and controlling the amount of time for which users can stay connected to a realm and its clients, helping to reduce the attack surface when sessions or tokens are leaked...

Managing tokens

As you learned from the previous section, tokens are usually bound to sessions. Therefore, the token validity – not necessarily their lifetimes – depends on sessions.

Tokens have their own lifetime and how long they are considered valid depends on how they are validated. By leveraging JSON Web Token (JWT) as a format for tokens, Keycloak enables applications to validate and inspect tokens locally without any additional roundtrip to the server. However, this capability has a consequence where tokens, although within their lifetime, might not be valid anymore if their sessions have expired.

Without taking this into account, you might end up in a situation where tokens are no longer valid (the sessions they are bound to have expired) but are still accepted by applications because they are within their lifetime, therefore increasing the attack surface if tokens are leaked. As you are going to learn in this section, you should always consider a clear...

Summary

In this chapter, you learned about some key aspects of token and session management. By leveraging what you learned from this chapter, you should be able to define clear policies for session expiration and token revocation considering their impacts on security, user experience, and the performance of applications and Keycloak.

In the next chapter, you are going to look at one of the main aspects of Keycloak – extensibility – and how to extend it to adapt and fulfill unmet needs.

Questions

1. Does Keycloak store sessions in the database?
2. What is the difference between user and client sessions?
3. How do you proactively revoke tokens and expire sessions?
4. How can applications validate tokens?
5. How does the access token lifetime impact clients?

Further reading

Refer to the following links for more information on the topics covered in this chapter:

• Keycloak user and session management: https://www.keycloak.org/docs/latest/server_admin/#user-session-management
• Mutual TLS client authentication: https://www.keycloak.org/docs/latest/server_admin/#advanced-settings
• Token revocation endpoint: https://tools.ietf.org/html/rfc7009
• Keycloak threat model mitigation: https://www.keycloak.org/docs/latest/server_admin/#compromised-access-and-refresh-tokens
• OAuth 2.0 threat model and security considerations: https://tools.ietf.org/html/rfc6819
• OAuth 2.0 security best current practice: https://www.keycloak.org/docs/latest/server_admin/#_account-service

Join our community on Discord

Join our community’s Discord space for discussions with the authors and other readers:

https://packt.link/SecNet