mathieupassenau

Hi, it's up to Keycloak admins to define the session expiration time. If "SSO Session Max" parameter is set to "10 hours", there's a good chance that this is still the default configuration... Like many other things in Keycloak such as "brute force detection" disabled, "roles" scope by default, etc...

Hi,

In this case, we use this procedure from the frontend app. When a user registers on Keycloak, this user is only stored on Keycloak.

Keycloak is used as an authentication provider, a "login with". The user is registered in the app on first use, even if the account already exists in Keycloak.

so, calling "api.add_user_if_not_exists" can be used on every request, only the first has an effect.

The field request.jwt.claim.sub is called "subject", this is a unique identifier for the user (a GUID with Keycloak). This field is provisionned by Keycloak, the JWT token has been verified by Postgrest with all informations (Keys).

Damn ! Keycloak on HN homepage ! We use it in production for years. Such a great tool, we deployed a "as a service" version, with a free offer => https://please-open.it

I wrote a blogpost about webanalytics and authentication. https://www.mathieupassenaud.fr/webanalytics_enemy/ Using "authorization code grant" is not as secure as we imagine with those kind of analytics

here it is : https://github.com/mathieupassenaud/codeless-backend have fun :)

not right now, in a few hours :)

Hi, yes that's it ! I have a "HAHAHAHA" label right now

http://www.mathieupassenaud.fr/gmail-auto-labels/img/hahahah...

Thanks a lot for the advice. I'll take a look at the fold space you mention ;)