clean-aquamarineC
Refine2y ago
8 replies
clean-aquamarine

AuthProvider and AccessControl mismatch during checkLoginIframe keycloak

There seems to be a mismatch in the context updates between the AuthProvider and the AccessControlProvider using keycloak default settings in our project.

By default KeyCloak checks the login states in an iframe. This can lead to the AccessControlProvider knowing that the client has logged out. Which in turn may be used to display AccessControl based components. Refine's internal authProvider does not check whether the user is still authenticated similarly to keycloak, and thus we have a situation where we set the role state globally to be an empty string with a logged out user, but the webpage still displays that the user is logged out because of refine's authentication (before refresh or user actions).

Current workaround exists on remounting the entire AuthProvider which seems to lead to weird implementations or simply setting keycloaks options as such: initOptions={{ checkLoginIframe: false }.

Is it somehow possible to trigger the AuthProvider to call the check() on changes of the AuthProvider? The KeyCloak instance has a changed keyCloakInstance.token so it seems logical to be able to have things like this as a dependency to the AuthContext and rerender.
Was this page helpful?