# Offline token invalid but not expired

**URL:** <https://forum.keycloak.org/t/offline-token-invalid-but-not-expired/12895>\
**Category:** Getting advice\
**Tags:** authentication, oidc\
**Created:** [January 5, 2022, 3:50pm UTC](https://forum.keycloak.org/t/offline-token-invalid-but-not-expired/12895 "2022-01-05T15:50:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebaclaudel](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@sebaclaudel](https://forum.keycloak.org/u/sebaclaudel)\
**Post date:** [January 5, 2022, 3:50pm UTC](https://forum.keycloak.org/t/offline-token-invalid-but-not-expired/12895/1 "2022-01-05T15:50:00Z")

</div>

Hi,

I have a problem with offline tokens. Some of them expire well before the limit. My offline tokens have an expiration period of 190 days (Offline Session Idle = 190d and Offline Session Max = 190d). To obtain them, my user goes through the authorization code grant flow and consents. The tokens are stored in a database and exchanged for access tokens with a client\_id client\_secret.

my users sometimes have this error that I cannot explain :

```auto
{
    "error": "invalid_grant",
    "error_description": "Session doesn't have required client"
}

```

I’m running keycloak 15.1.1 on a Kubernetes cluster of 3 nodes. The CACHE\_OWNER parameter is 2  
I’m using lazy loading Offline token with this setting :

```auto
<subsystem xmlns="urn:jboss:domain:keycloak-server:1.1">
    ...
    <spi name="userSessions">
        <default-provider>infinispan</default-provider>
        <provider name="infinispan" enabled="true">
            <properties>
                <property name="preloadOfflineSessionsFromDatabase" value="false"/>
            </properties>
        </provider>
    </spi>
    ...
</subsystem>

```

An idea ?

Thanks

Sebastien

---

<div class="post-metadata">

**Author:** ![sebaclaudel](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@sebaclaudel](https://forum.keycloak.org/u/sebaclaudel)\
**Post date:** [January 7, 2022, 8:51am UTC](https://forum.keycloak.org/t/offline-token-invalid-but-not-expired/12895/2 "2022-01-07T08:51:26Z")

</div>

Hi,

The problem is solved and it was indeed a cache problem. The CACHE\_OWNER parameter was the cause. We were losing sessions during the rolling update phase.

[https://www.keycloak.org/docs/latest/server\_installation/#\_replication](https://www.keycloak.org/docs/latest/server_installation/#_replication)

Thanks for your help,

Best regards

Sébastien

---

<div class="post-metadata">

**Author:** ![paulogabrielfs](https://avatars.discourse-cdn.com/v4/letter/p/e19b73/32.png) [@paulogabrielfs](https://forum.keycloak.org/u/paulogabrielfs)\
**Post date:** [March 2, 2023, 2:42pm UTC](https://forum.keycloak.org/t/offline-token-invalid-but-not-expired/12895/3 "2023-03-02T14:42:50Z")

</div>

Hi @sebaclaudel, we ar e having same issue.

Today we have 4 nodes and 2 CACHE\_OWNER, and we’re having that errors for sessions doesn’t have required clients.

After reading the documentation we have some questions.

You resolve by increasing cache\_owner? How many nodes you have in your environment and how much CACHE\_OWNER’s have you configured?

---

<div class="post-metadata">

**Author:** ![sebaclaudel](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@sebaclaudel](https://forum.keycloak.org/u/sebaclaudel)\
**Post date:** [March 2, 2023, 3:58pm UTC](https://forum.keycloak.org/t/offline-token-invalid-but-not-expired/12895/4 "2023-03-02T15:58:44Z")

</div>

Hi,  
We solved this by increasing the CACHE\_OWNER number. To avoid any problems, we set CACHE\_OWNER = Nodes.