access token or refresh token will be reset when another is set

Before reporting an issue

[X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

account/api

Describe the bug

When I set the SSO Session Settings :

click "Save".

I got:

{
    "access_token": "...",
    "expires_in": 300,
    "refresh_expires_in": 360,
    "refresh_token": "...",
    "token_type": "Bearer",
    "id_token": "...",
    "not-before-policy": 0,
    "session_state": "...",
    "scope": "openid email profile"
}

when make a POST request to http://localhost:8080/realms/{real_name}/protocol/openid-connect/token

Now the refresh_expires_in expires in 360s this is what I've set (6 minutes). And the access token expires in 300s (expires_in)

and then I go the Tokens Tab:

And change the Access Token Lifespan to 1 minute. click "Save".

make a POST request again. I got:

{
    "access_token": "..",
    "expires_in": 60,
    "refresh_expires_in": 1800,
    "refresh_token": "...",
    "token_type": "Bearer",
    "id_token": "...",
    "not-before-policy": 0,
    "session_state": "...",
    "scope": "openid email profile"
}

Now, the expires_in becomes 60s, this is correct. BUT the refresh token expire time (refresh_expires_in) becomes 1800s!

And if I go back to the Sessions Tab and click save again, the refresh_expires_in becomes 360 again. BUT the access token becomes to 300s!

Is this by design or a bug? It's pretty confusing and no idea why it's happening.

Version

25.0.4

Regression

[ ] The issue is a regression

Expected behavior

I expect that the access token and refresh token expire time can be set according to the account UI settings.

Actual behavior

The access token (refresh token) expiration times is reset when I set a value for refresh token (access token).

How to Reproduce?

Go to the account UI, and go to Ream Settings -> Sessions and Tokens tabs to set the value accordingly.

Anything else?

No response

Hi, I tried to redo this again and suddently it works as expected...

Absolutely so idea why.

Now I got:

{
    "access_token": "...",
    "expires_in": 120,
    "refresh_expires_in": 360,
    "refresh_token": "...",
    "token_type": "Bearer",
    "id_token": "...",
    "not-before-policy": 0,
    "session_state": "...",
    "scope": "openid email profile"
}

It seems that the account UI displayed a toast message Realm updated successfully to me, but in fact something was wrong and after a while when I tried again, it really worked.

UPDATE: after redo again, this issue happens again from time to time. I have to reload the page to make sure the set value is really set. After getting the toast message Realm updated successfully, and reload the page, the values are not really updated sometimes!

keycloak / keycloak