How to use

OIDCFilterSessionStore

in

org.keycloak.adapters.servlet

public HttpServletRequestWrapper buildWrapper() {
  HttpSession session = request.getSession(false);
  KeycloakAccount account = null;
  if (session != null) {
    account = (KeycloakAccount) session.getAttribute(KeycloakAccount.class.getName());
    if (account == null) {
      account = (KeycloakAccount) request.getAttribute(KeycloakAccount.class.getName());
    }
  }
  if (account == null) {
    account = (KeycloakAccount) request.getAttribute(KeycloakAccount.class.getName());
  }
  return buildWrapper(session, account);
}

@Override
public void logout() {
  HttpSession httpSession = request.getSession(false);
  if (httpSession != null) {
    SerializableKeycloakAccount account = (SerializableKeycloakAccount) httpSession.getAttribute(KeycloakAccount.class.getName());
    if (account != null) {
      account.getKeycloakSecurityContext().logout(deployment);
    }
    cleanSession(httpSession);
  }
}

protected void cleanSession(HttpSession session) {
  session.removeAttribute(KeycloakAccount.class.getName());
  session.removeAttribute(KeycloakSecurityContext.class.getName());
  clearSavedRequest(session);
}

OIDCFilterSessionStore tokenStore = new OIDCFilterSessionStore(request, facade, 100000, deployment, idMapper);
tokenStore.checkCurrentToken();
    return;
  } else {
    HttpServletRequestWrapper wrapper = tokenStore.buildWrapper();
    chain.doFilter(wrapper, res);
    return;

OIDCFilterSessionStore tokenStore = new OIDCFilterSessionStore(request, facade, 100000, deployment, keycloakRealm.getSessionIdMapper());
tokenStore.checkCurrentToken();

@Override
public boolean isCached(RequestAuthenticator authenticator) {
  HttpSession httpSession = request.getSession(false);
  if (httpSession == null) return false;
  SerializableKeycloakAccount account = (SerializableKeycloakAccount) httpSession.getAttribute(KeycloakAccount.class.getName());
  if (account == null) {
    return false;
  }
  log.fine("remote logged in already. Establish state from session");
  RefreshableKeycloakSecurityContext securityContext = account.getKeycloakSecurityContext();
  if (!deployment.getRealm().equals(securityContext.getRealm())) {
    log.fine("Account from cookie is from a different realm than for the request.");
    cleanSession(httpSession);
    return false;
  }
  if (idMapper != null && !idMapper.hasSession(httpSession.getId())) {
    log.fine("idMapper does not have session: " + httpSession.getId());
    //System.err.println("idMapper does not have session: " + httpSession.getId());
    cleanSession(httpSession);
    return false;
  }
  securityContext.setCurrentRequestInfo(deployment, this);
  request.setAttribute(KeycloakSecurityContext.class.getName(), securityContext);
  needRequestRestore = restoreRequest();
  return true;
}

@Override
public void servletRequestLogout() {
  logout();
}

@Override
public void checkCurrentToken() {
  HttpSession httpSession = request.getSession(false);
  if (httpSession == null) return;
  SerializableKeycloakAccount account = (SerializableKeycloakAccount)httpSession.getAttribute(KeycloakAccount.class.getName());
  if (account == null) {
    return;
  }
  RefreshableKeycloakSecurityContext session = account.getKeycloakSecurityContext();
  if (session == null) return;
  // just in case session got serialized
  if (session.getDeployment() == null) session.setCurrentRequestInfo(deployment, this);
  if (session.isActive() && !session.getDeployment().isAlwaysRefreshToken()) return;
  // FYI: A refresh requires same scope, so same roles will be set.  Otherwise, refresh will fail and token will
  // not be updated
  boolean success = session.refreshExpiredToken(false);
  if (success && session.isActive()) return;
  // Refresh failed, so user is already logged out from keycloak. Cleanup and expire our session
  //log.fine("Cleanup and expire session " + httpSession.getId() + " after failed refresh");
  cleanSession(httpSession);
  httpSession.invalidate();
}