I am using Keycloak to provide SSO through OIDC for a bunch of applications that belong to the same realm. All of these applications are confidential clients that use the Authorization Code flow. They use JSP for the views, and all necessary redirects are managed by Spring Boot and Spring Security Keycloak adapters.
After successfully logging in I can switch from one application to another correctly (SSO). For each of them, an HttpSession is generated containing a org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken. This class, has a details object (SimpleKeycloakAccount) with a securityContext (RefreshableKeycloakSecurityContext) that contains the access token (tokenString), id token (idTokenString) and refresh token (refreshTokenString):
The contained access token has a 5 minute expiration time. Oddly enough, after this time has passed, although I'm still correctly authenticated in the Spring Boot application, I've checked that the access token is never refreshed.
I need to have a valid access token, since some of these applications invoke REST services, secured with the same adapters with bearer only authentication. The problem is I end up having an expired access token and have to deal (manually?) with its expiration.
Is there a way to make the adapter refresh the access token when it expires or are we expected to do so programmatically?
Can you show how to do it?