Configuring Keycloak
Keycloak is the default authentication provider for Valtimo. It is used to authenticate users, and Valtimo can retrieve information about users and roles from Keycloak.
Session timeouts
The recommended Valtimo settings are:
SSO Session Idle: 30 minutes
SSO Session Max: 10 hours
Access Token Lifespan: 5 minutes
How to check or change these values
Log in to the Keycloak admin console.
In the top-left menu, click Manage realms.
Select the valtimo realm or any other realm you want to configure.
In the left menu, click Realm settings.
Click the Sessions tab.
Check that SSO Session Idle is set to 30 minutes and SSO Session Max is set to 10 hours.
If you changed anything, click Save at the bottom.
Click the Tokens tab.
Check that Access Token Lifespan is set to 5 minutes.
If you changed anything, click Save at the bottom.
What this does
If a user does nothing in the application for 30 minutes, they are automatically logged out.
A user is shown a "your session is about to expire" prompt 5 minutes before logout, so they can extend it.
Even with continuous use, a single login session lasts at most 10 hours before requiring a new login.
Logging out and refresh tokens
The recommended Valtimo setting is:
Revoke Refresh Token: ON
How to check or change this
Log in to the Keycloak admin console.
In the top-left menu, click Manage realms.
Select the valtimo realm or any other realm you want to configure.
In the left menu, click Realm settings.
Click the Tokens tab.
Find Revoke Refresh Token and make sure the toggle is ON.
If you changed anything, click Save at the bottom.
What this does
When a user logs out, this setting ensures their session cannot be silently reused. After logout, the user must log in again to access Valtimo.
Note: for up to 5 minutes after logout, an already-issued token may still work for direct API calls. This is expected and matches the Access Token Lifespan setting above. If your environment requires a shorter window, lower the Access Token Lifespan value (this will cause users' browsers to refresh tokens more often).
Properties for connecting to Keycloak
In order for Valtimo to connect to Keycloak, certain properties are necessary. There are two different location in which these properties can be placed.
The properties can be placed in the application.yml:
Or as an environment variable:
More information about these properties and other optional properties can be found in the Spring Security OAuth2 documentation.
Client roles
By default, Valtimo uses Keycloak realm roles. But Valtimo can be configured to also use the Keycloak client roles. To make use of Keycloak client roles together with the realm roles, the following property is needed:
or
Last updated