-
Story
-
Resolution: Done
-
Critical
-
RHODS_1.1_GA
-
3
-
False
-
False
-
No
-
-
-
-
-
-
1.0.14
-
No
-
Undefined
-
No
-
Yes
-
-
MODH Sprint 19, MODH Sprint 20, MODH Sprint 21, MODH Sprint 22, MODH Sprint 23
As Red Hat, we need to adhere to product security guidelines to avoid security issues for RHODS customers.
This story is to address a session management flaw as outlined in the threat modeling doc (item 9): https://docs.google.com/document/d/17sGYy8P3HSCpO7QeSSORU3ZUYkUNGQq-z3xJDrUyadM/edit#heading=h.wmz2ucb7quu3
When a user's credentials are revoked for the RHODS dashboard and JupyterHub, the system should automatically log users out of the service. Some scenarios:
1) User session times out
2) User no longer has access to RHODS based on removal from RHODS user or admin group
3) User's OpenShift access is removed
- is related to
-
RHODS-339 Able to login with expired sesssion
- Closed
- relates to
-
RHODS-1968 Session mgmt: Users are not logged out of JH/RHODS when removed from rhods-users/admins group
- Closed