Keycloak 和 nodeJS：无法使用过期的刷新令牌进行刷新

Question

EDIT: I've set a server on a vm, without Docker, and everything worked well, it looks like VM+Docker is too much layer.

I have a node backend, with a route protected with:

app.get('/api/user', keycloak.protect(), function(req, res) {
    res.json({ message: 'This is an USER endpoint payload' });
});

I have this keycloak.json:

{
  "realm": "MyRealm",
  "auth-server-url": "http://keycloak.com:8008/auth/",
  "ssl-required": "none",
  "resource": "sso_agt",
  "public-client": true,
  "confidential-port": 0
}

When I use this route, i'm redirected to the auth page. When i'm logged, it redirects me to the right url, but I have denied access, with this error in npm console:

Could not obtain grant code: Error: Unable to refresh with expired refresh token

In my keycloak console, i have a WARN type=CODE_TO_TOKEN_ERROR

I run keycloak with docker, on a Ubuntu Server VM.

Answer 1

Refresh tokens are no-expiration passwords, when combined with the clientId and client service allow for the generation of actual access tokens. Once a refresh token is marked as invalid, there is no way to get a new one without navigating the user through implicit login flow with the scope: offline set.

Answer 2

I've set a server on a vm, without Docker, and everything worked well, it looks like VM+Docker is too much layer.