-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
4.13.z, 4.12.z, 4.11.z, 4.10.z
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
Important
-
No
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
Console client session is deleted before inactivityTimeoutSeconds The console session timeout frequently and users feel unconfortable to work with the OCP web console
Version-Release number of selected component (if applicable):
I reproduced the issue in - OCP4.13.4 - OCP4.10.59
How reproducible:
Set accessTokenInactivityTimeoutSeconds for oauthclient console and monitor the consle accesstoken's lifespan
Steps to Reproduce:
1. Set accessTokenInactivityTimeoutSeconds for oauthclient console ~~~ # oc edit oauthclient console apiVersion: oauth.openshift.io/v1 grantMethod: auto kind: OAuthClient metadata: annotations: release.openshift.io/create-only: "true" name: console redirectURIs: - https://<console_callback_URL> secret: <unique_secret_associated_with_a_client> accessTokenInactivityTimeoutSeconds: 300 // set this option ~~~ 2. Login OCP web-console with userid/password from any IDP 3. Monitor tokens' lifespan and inactivityTimeoutSeconds // inactivityTimeoutSeconds was increased from 300s to 678s automatically, but the token was deleted at 8m44s since creation time // 678s is 11m18s ~~~ $ watch "oc get oauthaccesstokens.oauth.openshift.io; oc get oauthaccesstokens.oauth.openshift.io/sha256~[token-name] -oyaml" NAME USER NAME CLIENT NAME CREATED EXPIRES REDIRECT URI SCOPES sha256~M-62dbrLT6QKcC6jha8x0Ht6TnxUmwYd-ILk9aq8caQ quickcluster console 8m44s 2023-07-22 07:11:34 +0000 UTC https://console-openshift-console.apps.sh rocp4upi413ovn.lab.upshift.rdu2.redhat.com/auth/callback user:full apiVersion: oauth.openshift.io/v1 authorizeToken: sha256~XVAqkmYXI5tIyNpJlNTuNovRzA2EHyFTKmk3G5G-5MM clientName: console expiresIn: 86400 inactivityTimeoutSeconds: 678 // but the token deleted about 8m 44s since creation time kind: OAuthAccessToken metadata: creationTimestamp: "2023-07-21T07:11:34Z" name: sha256~M-62dbrLT6QKcC6jha8x0Ht6TnxUmwYd-ILk9aq8caQ resourceVersion: "6926538" uid: 9c026ea7-b615-4532-bf1a-00cda0d91e6d redirectURI: https://console-openshift-console.apps.shrocp4upi413ovn.lab.upshift.rdu2.redhat.com/auth/callback scopes: - user:full userName: quickcluster userUID: 603dace5-c686-4242-8adc-b797f1c8cc27 ~~~ 4. Console client oauthaccessstoken is deleted before "inactivityTimeoutSeconds"
Actual results:
Console client's oauthaccessstokens are deleted before "inactivityTimeoutSeconds"
Expected results:
Console client's oauthaccessstokens should be deleted alined with "inactivityTimeoutSeconds"
Additional info:
"InactivityTimeoutSeconds" is the value in seconds, from the CreationTimestamp, after which this token can no longer be used. The value is automatically incremented when the token is used. [1]https://docs.openshift.com/container-platform/4.13/rest_api/oauth_apis/useroauthaccesstoken-oauth-openshift-io-v1.html [2]https://docs.openshift.com/container-platform/4.13/rest_api/oauth_apis/oauthaccesstoken-oauth-openshift-io-v1.html