The Keycloak admin panel logging out after two to three minutes is typically caused by the default session timeout settings being too aggressive for administrative workflows. To resolve this, you must adjust the idle and max session durations within the Realm Settings of your specific realm. This change ensures that administrators remain authenticated during extended configuration tasks without unexpected interruptions.
Understanding Session Timeout Mechanics
Keycloak manages authentication sessions through two distinct time limits: Idle Timeout and Max Session Duration. The Idle Timeout determines how long a user can remain inactive before the session expires. If you navigate away from the admin console or leave it open without interaction for more than the configured period, the system considers the session stale. The Max Session Duration defines the absolute maximum time a session can exist from its creation, regardless of activity. By default, these values are often set to short intervals to prioritize security in production environments, which inadvertently affects administrators managing complex setups.
When an administrator encounters rapid logout loops, it is rarely a network issue or a browser cache problem. Instead, it is a direct result of the server rejecting the current token because it has exceeded the allowed lifespan. Fixing this requires accessing the correct configuration area. Many users mistakenly look for session controls under user management or global server settings, but these timeouts are scoped per realm. Therefore, you must select the specific realm you are administering to apply the changes correctly. For more context on how Keycloak handles authentication flows, see
Using Keycloak as a Reverse Proxy for 3rd Party API Authentication.
Navigating to Realm Settings
Accessing the correct menu structure is critical to avoiding configuration errors. Follow these steps to locate the timeout settings:
- Select Your Realm: In the top-left corner of the Keycloak Admin Console, click the dropdown menu that displays the current realm name (e.g., master). Choose the realm where you are experiencing the logout issues.
- Open Configuration: In the left-hand navigation menu, locate and click on the Realm Settings option. Do not confuse this with Users, Groups, or Client Scopes. The session management options are exclusively found within the Realm Settings section.
- Access the Tabs: Once inside Realm Settings, you will see several tabs at the top, such as General, Login, Users, Sessions, and Advanced. Click on the Sessions tab.
It is important to note that previous versions of Keycloak or different themes might display these options slightly differently, but the core path remains consistent. Avoid looking for a "Settings" tab under Sessions, as this does not exist in standard distributions. The session-specific configurations are nested directly under the Sessions tab within the main Realm Settings view.
Adjusting Idle and Max Session Durations
On the Sessions tab, you will find fields labeled
Idle Timeout and
Max Session Duration. These fields accept integer values representing minutes. To fix the rapid logout issue, you need to increase these values significantly.
For the
Idle Timeout, consider setting it to a value that accommodates your typical workflow duration. A common recommendation for administrative panels is between 60 and 120 minutes, depending on organizational policy. If you set this to 0, the idle timeout is disabled, meaning the session will only expire based on the Max Session Duration. However, disabling idle timeouts entirely may pose security risks if unattended workstations are accessed by unauthorized individuals.
For the
Max Session Duration, set a value that represents the longest possible continuous session you wish to allow. Setting this to 0 disables the maximum limit, allowing sessions to persist indefinitely as long as they remain active. Combining a high idle timeout with a high max duration effectively solves the immediate problem of frequent logouts. After entering your desired values, scroll to the bottom of the page and click the
Save button.
Verifying the Changes
Once saved, the new settings take effect immediately for all new sessions. Existing sessions may continue until their original expiration time unless you manually invalidate them. To verify the fix, open a new incognito window or clear your browser cookies for the Keycloak domain. Log in again using your administrator credentials. You should now be able to remain logged in for the duration specified in your new settings.
If you still experience issues, check if a reverse proxy or load balancer in front of Keycloak is enforcing its own timeout policies. Tools like Nginx or Apache can sometimes terminate connections before Keycloak processes them. Ensure that proxy timeouts are aligned with or exceed the Keycloak session settings. Additionally, review the server logs for any error messages related to token validation failures, which might indicate misconfigured clock synchronization between your server and clients. For troubleshooting other login-related anomalies, refer to
Keycloak Stuck on Loading Screen - Troubleshooting Guide.
Security Considerations
While increasing session timeouts improves usability, it reduces the security posture of your authentication server. Longer-lived sessions mean that if an administrator's device is compromised, the attacker has a wider window of opportunity to exploit the account. It is best practice to implement this change only for administrative accounts or specific realms that require long-duration access. For public-facing applications, keep idle timeouts short to minimize risk. Regularly audit active sessions and enforce strong password policies to mitigate the risks associated with extended login periods.
Frequently Asked Questions
Does changing the session timeout affect regular users?
Yes, the changes apply to all users authenticating against that specific realm. If you only want to extend timeouts for administrators, you cannot do so natively through realm settings alone; you would need separate realms or custom client configurations.
How do I disable the idle timeout completely?
Set the
Idle Timeout field to 0 in the Sessions tab of Realm Settings. This removes the inactivity constraint, relying solely on the Max Session Duration for expiration.
Why did my session expire even though I was active?
This usually indicates that the Max Session Duration was reached rather than the Idle Timeout. Check the total time since login against the Max Session Duration setting, as this timer runs continuously regardless of user activity.
Can I reset sessions for all users at once?
Keycloak does not provide a single button to revoke all sessions instantly via the UI. You can use the
kcadm.sh command-line tool to delete sessions programmatically, but this requires proper CLI setup and administrative privileges.
What happens if I set the timeout too high?
Setting excessively high timeouts increases the risk of session hijacking if devices are lost or stolen. Balance convenience with security by choosing the shortest duration that still supports your operational needs.