Uploaded image for project: 'Satellite'
  1. Satellite
  2. SAT-38951

idle timout setting acting strangely

XMLWordPrintable

    • Known Issue
    • Hide
      .Some endpoints bypass user authentication and fail to terminate user sessions

      API endpoints that call the `add_smart_proxy_filters` function bypass user authentication.
      This is due to improper session termination logic introduced in Satellite 6.18.
      In addition, user sessions remain active beyond the period specified in the `idle_timeout` setting.
      This affects the API endpoints related to the following resources:

      * Organizations
      * Repositories
      * Config reports
      * Hosts

      As a consequence, removed and nonexistent users fail due to missing required permissions and not due to failed authentication.
      In addition, user sessions are not terminated and can access endpoints without re-authentication.

      No known workaround exists.
      Show
      .Some endpoints bypass user authentication and fail to terminate user sessions API endpoints that call the `add_smart_proxy_filters` function bypass user authentication. This is due to improper session termination logic introduced in Satellite 6.18. In addition, user sessions remain active beyond the period specified in the `idle_timeout` setting. This affects the API endpoints related to the following resources: * Organizations * Repositories * Config reports * Hosts As a consequence, removed and nonexistent users fail due to missing required permissions and not due to failed authentication. In addition, user sessions are not terminated and can access endpoints without re-authentication. No known workaround exists.
    • Done
    • Automated
    • Yes

      Description of problem:

      Idle timeout setting does not terminate cli session in specified time.

      How reproducible:

      Always

      Is this issue a regression from an earlier version:

      yes 

      Steps to Reproduce:

      found by robottelo automation, using this test https://github.com/SatelliteQE/robottelo/blob/5bf229ccad326b9c83b9b37fb33d1bd763624818/tests/foreman/cli/test_auth.py#L90 (test_positive_create_session) – after the idle period passes, user can still list organizations without problem (I tried to increase the waiting time up to 5 times of the idle period, still the session was not terminated)

      1. set up a cli session for a user

      2. set idle timeout period for 1 minute

      3. wait some time, try to list organization

      Actual behavior:
      session is not terminated

      Expected behavior:
      user should need to re-authenticate after the idle period passes

      Business Impact / Additional info:

      6.17 version of the test works as expected

              rhn-engineering-jlenz Jeremy Lenz
              pondrejk@redhat.com Peter Ondrejka
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: