Uploaded image for project: 'OpenShift Authentication'
  1. OpenShift Authentication
  2. AUTH-353

Logout links do not expire user token for OCP OAuth clients

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Undefined Undefined
    • None
    • openshift-4.11
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Suppose a user logs in to Argo/GitOps using the log-in via the openshift button or DevSpaces. In that case, the user's session remains active even after the user clicks the logout link.

      In DevSpaces, for example, the /oauth/sign_out is called correctly, so we expect the code invalidating active tokens to be in the OpenShift Authentication.
      https://github.com/eclipse-che/che-dashboard/blob/main/packages/dashboard-frontend/src/services/helpers/login.ts#L18

      The logout link on the Openshift Console (after adding a logoutRedirect to RH-SSO) does expire all of a user's sessions.

              Unassigned Unassigned
              rhn-support-rludva Radomir Ludva
              None
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: