Session Management

# revokeRefreshToken=true turns on rotation; refreshTokenMaxReuse=0 means
# zero permitted reuses, so any second use of a consumed refresh token
# revokes the session. Lifetimes are set to modest lab values.
docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh update realms/northgate \
  -s revokeRefreshToken=true \
  -s refreshTokenMaxReuse=0 \
  -s ssoSessionIdleTimeout=1800 \
  -s ssoSessionMaxLifespan=36000

# Direct grant used for lab convenience to establish a session.
RESP=$(curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=hr-portal" \
  -d "client_secret=REPLACE_WITH_HR_PORTAL_SECRET" \
  -d "grant_type=password" \
  -d "username=asmith" \
  -d "password=REPLACE_WITH_ASMITH_PASSWORD" \
  -d "scope=openid profile")

RT_A=$(echo "$RESP" | jq -r '.refresh_token')

# First refresh: present RT_A, receive RT_B.
RESP2=$(curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=hr-portal" \
  -d "client_secret=REPLACE_WITH_HR_PORTAL_SECRET" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=$RT_A")

RT_B=$(echo "$RESP2" | jq -r '.refresh_token')
echo "RT_A and RT_B differ: $([ "$RT_A" != "$RT_B" ] && echo yes || echo no)"

# The attacker presents the OLD refresh token RT_A, which was already
# consumed when RT_B was issued. This is the reuse.
echo "=== Attacker reuses consumed RT_A ==="
curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=hr-portal" \
  -d "client_secret=REPLACE_WITH_HR_PORTAL_SECRET" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=$RT_A" | jq '{error, error_description}'

# Now the LEGITIMATE client tries to use its current, valid RT_B. Because the
# reuse revoked the whole session, even the good token no longer works.
echo "=== Legitimate client tries its current RT_B afterwards ==="
curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=hr-portal" \
  -d "client_secret=REPLACE_WITH_HR_PORTAL_SECRET" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=$RT_B" | jq '{error, error_description}'

# rp.py
# A minimal relying party. It holds a set of "active local sessions" keyed by
# the Keycloak session id (sid). When Keycloak POSTs a back-channel logout
# token, the RP validates it and removes the matching local session.

import json
import time
import requests
from flask import Flask, request, jsonify
from jwcrypto import jwt, jwk

app = Flask(__name__)
ISSUER = "https://ib-lb:8443/realms/northgate"
JWKS_URL = f"{ISSUER}/protocol/openid-connect/certs"
CLIENT_ID = "hr-portal"
requests.packages.urllib3.disable_warnings()
_jwks = jwk.JWKSet.from_json(requests.get(JWKS_URL, verify=False).text)

# Demo local session store: sid -> username. Populated at login in a real RP;
# seeded here via /debug/seed for the lab.
LOCAL_SESSIONS = {}


@app.post("/debug/seed")
def seed():
    body = request.get_json(force=True)
    LOCAL_SESSIONS[body["sid"]] = body["username"]
    return jsonify({"active_sessions": LOCAL_SESSIONS})


@app.post("/backchannel-logout")
def backchannel_logout():
    logout_token = request.form.get("logout_token", "")
    try:
        verified = jwt.JWT(jwt=logout_token, key=_jwks, algs=["RS256"])
        claims = json.loads(verified.claims)
    except Exception as e:
        return jsonify({"error": f"invalid logout token: {e}"}), 400

    # Required checks per the OIDC Back-Channel Logout specification.
    if claims.get("iss") != ISSUER:
        return jsonify({"error": "issuer mismatch"}), 400
    aud = claims.get("aud")
    aud_list = aud if isinstance(aud, list) else [aud]
    if CLIENT_ID not in aud_list:
        return jsonify({"error": "audience mismatch"}), 400
    events = claims.get("events", {})
    if "http://schemas.openid.net/event/backchannel-logout" not in events:
        return jsonify({"error": "not a back-channel logout event"}), 400
    # A logout token must NOT contain a nonce, and must contain sub or sid.
    if "nonce" in claims:
        return jsonify({"error": "logout token must not contain nonce"}), 400

    sid = claims.get("sid")
    removed = LOCAL_SESSIONS.pop(sid, None) if sid else None
    return jsonify({"terminated_sid": sid, "was_active": removed is not None,
                    "remaining": LOCAL_SESSIONS}), 200


@app.get("/sessions")
def sessions():
    return jsonify(LOCAL_SESSIONS)


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8098, ssl_context="adhoc")

export FLASK_ENV=development
python3.11 rp.py   # listens on https://localhost:8098

# Replace HR_PORTAL_UUID with the hr-portal client UUID from Lab 02.
# From the host, ib-rp is reachable on the Docker network; use the container
# name if the RP runs as a container, or host.docker.internal if it runs on
# the host and Keycloak runs in Docker. Adjust to your setup.
docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh update \
  clients/HR_PORTAL_UUID -r northgate \
  -s 'attributes."backchannel.logout.url"=https://ib-rp:8098/backchannel-logout' \
  -s 'attributes."backchannel.logout.session.required"=true'

# Establish a Keycloak session and capture its sid from the ID token.
RESP=$(curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=hr-portal" -d "client_secret=REPLACE_WITH_HR_PORTAL_SECRET" \
  -d "grant_type=password" -d "username=asmith" \
  -d "password=REPLACE_WITH_ASMITH_PASSWORD" -d "scope=openid profile")
ID_TOKEN=$(echo "$RESP" | jq -r '.id_token')
SID=$(echo "$ID_TOKEN" | cut -d. -f2 | tr '_-' '/+' | \
  awk '{l=length($0)%4; if(l>0)for(i=0;i<4-l;i++)$0=$0"="; print}' | \
  base64 -d 2>/dev/null | jq -r '.sid')

# Mirror that session into the RP's local store.
curl -sk -X POST https://localhost:8098/debug/seed \
  -H "Content-Type: application/json" \
  -d "{\"sid\":\"$SID\",\"username\":\"asmith\"}" | jq

# Now force-logout the user's sessions as an administrator. This is also the
# exact containment action used in Lab 33.
USER_ID=$(docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh get \
  users -r northgate -q username=asmith --fields id | jq -r '.[0].id')
docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh create \
  users/$USER_ID/logout -r northgate

# The RP should have received a logout token and dropped the session.
sleep 2
curl -sk https://localhost:8098/sessions | jq

# Count active sessions for the hr-portal client via the Admin REST API.
docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh get \
  clients/HR_PORTAL_UUID/session-count -r northgate

# Confirm the cluster sees both nodes and the session caches are distributed.
# The exact cache names are 'sessions', 'clientSessions', 'offlineSessions'
# and 'offlineClientSessions'. Cache metrics are exposed on the management
# port if enabled in Lab 06.
docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh get \
  serverinfo -r master | jq '.systemInfo.serverTime, .memoryInfo.total'

# Establish a fresh session and keep its refresh token.
RESP=$(curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=hr-portal" -d "client_secret=REPLACE_WITH_HR_PORTAL_SECRET" \
  -d "grant_type=password" -d "username=jpatel" \
  -d "password=REPLACE_WITH_JPATEL_PASSWORD" -d "scope=openid profile")
RT=$(echo "$RESP" | jq -r '.refresh_token')

# Simulate the failure of one node.
docker stop ib-keycloak-1

# The load balancer routes the next refresh to ib-keycloak-2, which must
# already hold the session because the caches have two owners.
sleep 3
curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=hr-portal" -d "client_secret=REPLACE_WITH_HR_PORTAL_SECRET" \
  -d "grant_type=refresh_token" -d "refresh_token=$RT" \
  | jq '{ok: (.access_token != null), error}'

# Restore the node for later labs.
docker start ib-keycloak-1