Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-8825

[MSTR-1130] Management Console logout fails to invalidate the token if there is no clusterrolebinding/system:oauth-token-deleters which is deprecated and to be future removed by the enhancement doc

XMLWordPrintable

    • Quality / Stability / Reliability
    • None
    • None
    • None
    • Moderate
    • None
    • All
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      For testing MSTR-1130, deleted system:oauth-token-deleters, then
      oc Management console logout fails to invalidate the token even if the request deletes oauthaccesstoken tokenname

      Version-Release number of selected component (if applicable):
      4.7.0-0.nightly-2020-12-20-031835

      How reproducible:
      always

      Steps to Reproduce:
      1. Login to web console
      2. Check `oc get oauthaccesstoken`
      3. In web console, press F12, click "Network" tab, select the request and go to 'cookies' tab. Get the 'openshift-session-token'. then log out from web console. Check `oc get oauthaccesstoken` again.
      4. On Cli, run oc whoami --token=<token>, Should not show username.
      5, On cli, run oc login --token=<token>, should not login

      Actual results:

      Got token from broswer cookie : sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********

      On CLI :

      $ oc whoami --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
      testuser-44

      Logout from Console. Can see openshift-session-token "" (blank)

      On CLI :

      $ oc whoami --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
      testuser-44

      $ oc login --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
      Logged into "https://api...." as "testuser-44" using the token provided.

      Expected results:

      $ oc whoami --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
      error: You must be logged in to the server (Unauthorized)

      $ oc login --token=sha256~0sFP760XZXlWyEhZ-CRs2CDjCog13vuMqyQ********
      error: You must be logged in to the server (Unauthorized)

      Additional info:

      In the logout (no matter oc or console or any other) should use useroauthaccesstoken instead of oauthaccesstoken due to the clusterrolebinding is deprecated and will be removed soon in next 4.8 version

              jhadvig@redhat.com Jakub Hadvig
              rhn-support-pmali Pravin Mali (Inactive)
              None
              None
              YaDan Pei YaDan Pei
              None
              Red Hat Employee
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: