-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
4.8
-
Quality / Stability / Reliability
-
None
-
None
-
None
-
Moderate
-
None
-
All
-
None
-
None
-
None
-
None
-
If docs needed, set a value
-
None
-
None
-
None
-
None
-
None
Description of problem:
For testing MSTR-1130, deleted system:oauth-token-deleters, then
oc Management console logout fails to invalidate the token even if the request deletes oauthaccesstoken tokenname
Version-Release number of selected component (if applicable):
4.7.0-0.nightly-2020-12-20-031835
How reproducible:
always
Steps to Reproduce:
1. Login to web console
2. Check `oc get oauthaccesstoken`
3. In web console, press F12, click "Network" tab, select the request and go to 'cookies' tab. Get the 'openshift-session-token'. then log out from web console. Check `oc get oauthaccesstoken` again.
4. On Cli, run oc whoami --token=<token>, Should not show username.
5, On cli, run oc login --token=<token>, should not login
Actual results:
Got token from broswer cookie : sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
On CLI :
$ oc whoami --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
testuser-44
Logout from Console. Can see openshift-session-token "" (blank)
On CLI :
$ oc whoami --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
testuser-44
$ oc login --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
Logged into "https://api...." as "testuser-44" using the token provided.
Expected results:
$ oc whoami --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
error: You must be logged in to the server (Unauthorized)
$ oc login --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
error: You must be logged in to the server (Unauthorized)
Additional info:
In the logout (no matter oc or console or any other) should use useroauthaccesstoken instead of oauthaccesstoken due to the clusterrolebinding is deprecated and will be removed soon in next 4.8 version