Keycloak Refresh Token

Description

General

• Documentation: https://www.keycloak.org/securing-apps/oidc-layers
• Summary: Keycloak is the open-source identity and access management server stewarded by Red Hat and the CNCF, providing single sign-on, user federation and OAuth 2.0 / OpenID Connect / SAML for applications. Organisations self-host it and isolate their users and clients into "realms". A Keycloak refresh token is redeemed at the realm's token endpoint for fresh access tokens, so it grants lasting access to every application behind that Keycloak deployment. Tokens minted with the offline_access scope (typ: Offline) carry no expiry at all and survive session expiry, browser state loss and server restarts, which makes a leaked one usable indefinitely.

Revoke the secret

In the admin console of the issuing realm (the realm named in the token's iss claim), open Users > the user of the sub claim > Consents and revoke the consent for the client named in the azp claim, which drops its offline sessions; regular refresh tokens are dropped by signing the session out under Sessions. Alternatively regenerate the credentials of that client under Clients > Credentials, or disable the client, which invalidates every refresh token issued to it.

Details for Keycloak Refresh Token

• Family: token

• Category: identity_provider

• Company: Keycloak

• High recall: False

• Validity check available: True

• Analyzer available: False

• Revoker available: False

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Occurrences found for one million commits: 0.475

• Prefixed: False