API Admin User Sessions

[jotwg]

Hi,

I successfully set up an API admin user as described in the optional module settings of the auth-keycloak module. Each time a user logs on or off, a new sessions for the api-admin user will be created in keycloak, so far so good.

The problem is: those sessions stay active for long time (seems til the general session timeout, which is 10h in my case).
I would expect that those api-admin sessions will be terminated after seconds.

Thx!

auth-keycloak version: 1.4.4
HumHub version: 1.17.4 CE

[marc-farre]

@jotwg Thanks for reporting this issue.
Unfortunately, I don't really understand which session you are talking about.
API requests are made via https://github.com/MohammadWaleed/keycloak-admin-client library, v0.38.0
Can you point out in the code https://github.com/cuzy-app/auth-keycloak, where this session would be created?
Where do you see it? In Keycloak admin?

[jotwg]

sorry for my late response....
Yes, I see those sessions in Keycloak sessions list. Related events are:

auth_method openid-connect
token_id onrtro:0f33e0dc-474e-f75b-2ea8-5f62f4cff98e
grant_type password
refresh_token_type Refresh
scope profile email
refresh_token_id c53d2d5b-81e3-694d-7274-049659df5837
client_auth_method client-secret
username api-admin

Actually I see at least 2 api-admin sessions per regular user and all of them remain active even after users have logged out.

[jotwg]

@marc-farre

(...) Can you point out in the code https://github.com/cuzy-app/auth-keycloak, where this session would be created? Where do you see it? In Keycloak admin?

As far as I can see (I'm not familiar with PHP), each call of KeycloakApi functions are made like this:
(new KeycloakApi())->revokeUserSession($user->id);
(see .../protected/modules/auth-keycloak/Events.php)
which will create a new api-admin session in keycloak which leads to hundreds of sessions. Shouldn't there be only a single session for the API admin user?

Merci!

[marc-farre]

@jotwg revokeUserSession() is triggered only when a user disconnects from HumHub, and when this feature is enabled.
This is the normal way of sending the API request, see https://github.com/MohammadWaleed/keycloak-admin-client?tab=readme-ov-file#realms-admin
So perhaps there is an issue with https://github.com/MohammadWaleed/keycloak-admin-client library, I don't know.