Repository navigation
Automatic Refresh of Tokens from External Identity Providers #53805
alexis-bertaux
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I would like to propose an idea regarding external Identity Providers (IDPs).
Why doesn’t Keycloak provide a configuration option on IDPs, such as a boolean flag, that would automatically refresh external provider tokens when they are about to expire?
Today, refreshing those tokens generally requires:
calling the /broker/{provider}/token endpoint,
or using token exchange mechanisms.
The idea would be to allow Keycloak to refresh external tokens automatically in the background as long as a valid refresh token is available.
One important benefit is that regularly refreshing the external tokens would also help keep the session alive on the external IDP side. This could simplify SSO management in more complex architectures and improve the user experience by reducing unnecessary re-authentication flows.
This could especially be useful for integrations with providers such as Azure AD, Google, GitHub, or other OIDC/OAuth2 identity providers where long-lived federated sessions are expected.
What do you think about adding such a feature natively in Keycloak?
All reactions