Session Expiration and Keycloak

[brandonk10]

This is probably a keycloak question, but I'm having trouble hunting this down. I'm running into a problem configuring the session expiration. My access token has a 30 minute timeout that I can see in the logs, but the session timeout is configured to 5 minutes.

[Tue Nov 09 09:56:12.903209 2021] [auth_openidc:debug] [pid 1691793:tid 1691965] src/util.c(1862): [client 192.168.1.124:43845] oidc_util_set_app_info: setting environment variable "OIDC_access_token_expires: 1636471572"
[Tue Nov 09 09:56:12.903214 2021] [auth_openidc:debug] [pid 1691793:tid 1691965] src/mod_auth_openidc.c(866): [client 192.168.1.124:43845] oidc_log_session_expires: session inactivity timeout: Tue, 09 Nov 2021 15:01:12 GMT (in 299 secs from now)

According to the description for OIDCSessionMaxDuration, it defaults to the id token expiration, but I can't find this value in my keycloak token settings. The only token settings set to 5 minutes are the Login action timeout and the user-initiated action lifespan.

Does someone know where the id token expiration is configured?

Currently using 2.4.8.4.

Thanks

[zandbelt]

it seems you're mixing up inactivity timeout and session duration, see: https://github.com/zmartzone/mod_auth_openidc/wiki/Session-management-settings; anyhow, by default the id_token expiry does translate into a timeout in mod_auth_openidc

[brandonk10]

Possibly. What I'm trying to determine is how to control the id_token expiry in keycloak so it affects the session timeout in mod_auth_openidc.

[brandonk10]

Sorry, you are 100% right. OIDCSessionInactivityTimeout was the issue.