docs: B-1 — Redis moves the session and leaves the tokens behind

Adding Spring Session Redis grows the context by 81 beans and swaps sessionRepository for RedisSessionRepository, while authorizedClientService stays InMemoryOAuth2AuthorizedClientService. The user then reads as logged in with principal labuser while accessTokenStoredOnServer is false, which is worse than being logged out.

Redis holds only the security context, serialized with Java native serialization, and the refresh token is not there to encrypt in the first place. Three problems on the way: Kubernetes service links overwrote REDIS_PORT with a tcp:// URL, the tests tried to reach Redis, and the resource server was never deployed so a DNS failure looked like a token failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bff/pom.xml

@@ -29,6 +29,19 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-oauth2-client</artifactId>
         </dependency>
+
+        <!-- B-1: Application Session 을 Redis 로 옮긴다.
+             spring-session-data-redis 가 SessionRepository 를 갈아끼우고,
+             spring-boot-starter-data-redis 가 연결(Lettuce)을 제공한다.
+             둘 다 있어야 자동구성이 걸린다 — 하나만 넣으면 조용히 in-memory 로 남는다. -->
+        <dependency>
+            <groupId>org.springframework.session</groupId>
+            <artifactId>spring-session-data-redis</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-redis</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>

bff/src/main/resources/application.yml

@@ -10,6 +10,17 @@ server:
 spring:
   application:
     name: keycloak-bff
+  data:
+    redis:
+      host: ${REDIS_HOST:localhost}
+      port: ${REDIS_PORT:6379}
+  session:
+    # Application Session 만 Redis 로 간다. OAuth2AuthorizedClient 는
+    # 이 설정과 무관하며 여전히 InMemory 다 — 조회 키가 다르기 때문이다(B-0).
+    store-type: ${SPRING_SESSION_STORE_TYPE:redis}
+    timeout: ${SPRING_SESSION_TIMEOUT:30m}
+    redis:
+      namespace: bff:session
   security:
     oauth2:
       client:

bff/src/test/java/com/example/keycloakpattern/bff/BffControllerTest.java

@@ -24,6 +24,9 @@ import org.springframework.test.web.servlet.MockMvc;
 
 @SpringBootTest(properties = {
     "KEYCLOAK_CLIENT_SECRET=test-only-secret",
+    // 테스트는 Redis 를 띄우지 않는다. store-type=none 이면 자동구성이
+    // 서블릿 컨테이너 기본 세션으로 되돌아가 컨텍스트가 뜬다.
+    "spring.session.store-type=none",
     "resource-api.base-url=http://127.0.0.1:9"
 })
 @AutoConfigureMockMvc