Keycloak Access Token
Description
General
- Documentation: https://www.keycloak.org/securing-apps/oidc-layers
- Summary: Keycloak is the open-source identity and access management server stewarded by Red Hat and the CNCF, providing single sign-on, user federation and OAuth 2.0 / OpenID Connect / SAML for applications. Organisations self-host it and isolate their users and clients into "realms". A Keycloak access token is a short-lived bearer JWT issued to a signed-in user or client by one realm, and it authenticates and authorises calls to every application sitting behind that Keycloak deployment, with the permissions carried by its realm and client roles.
Revoke the secret
Keycloak has no per-token revocation for access tokens, but they are
short-lived (5 minutes by default) and are tied to a session that can be
killed. In the admin console of the issuing realm (the realm named in the
token's iss claim), either log out the session listed under Sessions, or
open Users > the user of the sub claim > Sessions and sign it out. To cut
off everything a compromised client can obtain, regenerate the credentials
of the client named in the azp claim under Clients > Credentials, or
disable that client.
Details for Keycloak Access Token
-
Family: token
-
Category: identity_provider
-
Company: Keycloak
-
High recall: False
-
Validity check available: True
-
Analyzer available: False
-
Revoker available: False
-
On-premise instances exist: False
-
Only valid secrets raise an alert: False
-
Occurrences found for one million commits: 0.2
-
Prefixed: False
