From Session Removal To Token Invalidation

Help
1

Hello, I’m using the latest version of Directus with the latest version of keycloak.
I’m using a openid mode session.

As i noticed, the directus_session_token does not invalidate when the admin remove the keycloak session of that user from the keycloak UI.
I imagine that’s for optimization purposes but is there a turnaround for this?

As i saw, i can create custom events on keycloak, and wouldn’t be hard to create a custom directus extension that take my keycloak session id when i log him out, and use it to invalidate it as the admin required.
But is that possible?

Am i doing something wrong?

2

Hi,

You’re on the right track. You could create a custom http endpoint flow in Directus and then handle any events sent from your Keycloak instance.

Then in the flow, update users where external_identifier = the keycloak id.

{
    "data": {
        "status": "suspended"
    },
    "query": {
        "filter": {
            "external_identifier": {
                "_eq": "[Keycloak ID]"
            }
        }
    }
}