fix: treat Keycloak refresh_expires_in=0 as never-expires sentinel#4060

Open

strawgate wants to merge 10 commits into

mainfrom

codex/keycloak-fix

Commits on May 13, 2026

fix: treat Keycloak refresh_expires_in=0 as never-expires sentinel
strawgate
committed
fix: skip fallback expiry when Keycloak sends refresh_expires_in=0

strawgate
and
Copilot
committed
Fix: remove keycloak_never_expires flag, let val<=0 fallthrough to default

strawgate
and
Copilot
committed
fix: clear stale refresh_token_expires_at for Keycloak offline tokens on subsequent refreshes

strawgate
and
Copilot
committed
feat: add KeycloakOAuthProxy with offline token support

strawgate
and
Copilot
committed
refactor: replace flag with _upstream_refresh_token_never_expires override

strawgate
and
Copilot
committed

Commits on May 17, 2026

Commits on May 19, 2026

fix: forward resource_base_url and issuer_url through KeycloakOAuthProxy

strawgate
and
claude
committed