使用 Keycloak 在我的 Spring-Boot 应用程序中控制用户状态（连接/断开连接）

Question

I have a user-management REST application (Spring-Boot) integrated with Keycloak , and I would like to know if there is any way to see the status ( connected or disconnected ) of my clients.

I have in mind is to create a table in my database with an user-identifier and a boolean, and each time have Front make login, update the boolean to true , and when logging-out update the boolean to false .

But I have a problem with sessions. If a user does not log-out (the application is left open in the background), but the token expires, how can I control this?

Is there a simpler way to control user states ?

Answer 1

Why don't you go session-less (user state from Jwt access-token only)?

You can have a look at those tutorials which setup various spring-boot resource servers: https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials

If user is "disconnected" client should send request without authorization header (or invalid token) and spring security context will be populated with AnonymousAuthenticationToken (if anonymous was enabled in your conf) => access will only be allowed if request path is configured with permitAll()