mathieupassenau

Hi, it's up to Keycloak admins to define the session expiration time. If "SSO Session Max" parameter is set to "10 hours", there's a good chance that this is still the default configuration... Like many other things in Keycloak such as "brute force detection" disabled, "roles" scope by default, etc...

Hi,

In this case, we use this procedure from the frontend app. When a user registers on Keycloak, this user is only stored on Keycloak.

Keycloak is used as an authentication provider, a "login with". The user is registered in the app on first use, even if the account already exists in Keycloak.

so, calling "api.add_user_if_not_exists" can be used on every request, only the first has an effect.

The field request.jwt.claim.sub is called "subject", this is a unique identifier for the user (a GUID with Keycloak). This field is provisionned by Keycloak, the JWT token has been verified by Postgrest with all informations (Keys).