Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-16633

Console client session is deleted before inactivityTimeoutSeconds

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 4.13.z, 4.12.z, 4.11.z, 4.10.z
    • Management Console
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Important
    • No
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      Console client session is deleted before inactivityTimeoutSeconds
      The console session timeout frequently and users feel unconfortable to work with the OCP web console

      Version-Release number of selected component (if applicable):

      I reproduced the issue in
      - OCP4.13.4
      - OCP4.10.59

      How reproducible:

      Set accessTokenInactivityTimeoutSeconds for oauthclient console and monitor the consle accesstoken's lifespan

      Steps to Reproduce:

      1. Set accessTokenInactivityTimeoutSeconds for oauthclient console
      ~~~
      # oc edit oauthclient console
      apiVersion: oauth.openshift.io/v1
      grantMethod: auto
      kind: OAuthClient
      metadata:
        annotations:
          release.openshift.io/create-only: "true"
        name: console
      redirectURIs:
      - https://<console_callback_URL>
      secret: <unique_secret_associated_with_a_client>
      accessTokenInactivityTimeoutSeconds: 300   // set this option
      ~~~
      
      2. Login OCP web-console with userid/password from any IDP 
      
      3. Monitor tokens' lifespan and inactivityTimeoutSeconds
      // inactivityTimeoutSeconds was increased from 300s to 678s automatically, but the token was deleted at 8m44s since creation time
      // 678s is 11m18s
      ~~~
      $ watch "oc get oauthaccesstokens.oauth.openshift.io; oc get oauthaccesstokens.oauth.openshift.io/sha256~[token-name] -oyaml"
      
      NAME                                                 USER NAME      CLIENT NAME   CREATED   EXPIRES                         REDIRECT URI
                                                                 SCOPES
      sha256~M-62dbrLT6QKcC6jha8x0Ht6TnxUmwYd-ILk9aq8caQ   quickcluster   console      8m44s     2023-07-22 07:11:34 +0000 UTC   https://console-openshift-console.apps.sh
      rocp4upi413ovn.lab.upshift.rdu2.redhat.com/auth/callback   user:full
      
      apiVersion: oauth.openshift.io/v1
      authorizeToken: sha256~XVAqkmYXI5tIyNpJlNTuNovRzA2EHyFTKmk3G5G-5MM
      clientName: console
      expiresIn: 86400
      inactivityTimeoutSeconds: 678   // but the token deleted about 8m 44s since creation time
      kind: OAuthAccessToken
      metadata:
        creationTimestamp: "2023-07-21T07:11:34Z"
        name: sha256~M-62dbrLT6QKcC6jha8x0Ht6TnxUmwYd-ILk9aq8caQ
        resourceVersion: "6926538"
        uid: 9c026ea7-b615-4532-bf1a-00cda0d91e6d
      redirectURI: https://console-openshift-console.apps.shrocp4upi413ovn.lab.upshift.rdu2.redhat.com/auth/callback
      scopes:
      - user:full
      userName: quickcluster
      userUID: 603dace5-c686-4242-8adc-b797f1c8cc27
      
      ~~~
      4. Console client oauthaccessstoken is deleted before "inactivityTimeoutSeconds"

      Actual results:

      Console client's oauthaccessstokens are deleted before "inactivityTimeoutSeconds"

      Expected results:

      Console client's oauthaccessstokens should be deleted alined with "inactivityTimeoutSeconds"

      Additional info:

      "InactivityTimeoutSeconds" is the value in seconds, from the CreationTimestamp, after which this token can no longer be used. The value is automatically incremented when the token is used.
      
      [1]https://docs.openshift.com/container-platform/4.13/rest_api/oauth_apis/useroauthaccesstoken-oauth-openshift-io-v1.html
      
      [2]https://docs.openshift.com/container-platform/4.13/rest_api/oauth_apis/oauthaccesstoken-oauth-openshift-io-v1.html

              jhadvig@redhat.com Jakub Hadvig
              rhn-support-hyoskim Sophia Hyosun Kim
              None
              None
              YaDan Pei YaDan Pei
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: