Bug 1650684
Summary: | [RFE] Invalidate Active Sessions when User Password Changed | ||
---|---|---|---|
Product: | Red Hat Satellite | Reporter: | Karl Abbott <kabbott> |
Component: | Users & Roles | Assignee: | satellite6-bugs <satellite6-bugs> |
Status: | CLOSED WONTFIX | QA Contact: | Radovan Drazny <rdrazny> |
Severity: | medium | Docs Contact: | |
Priority: | high | ||
Version: | 6.3.2 | CC: | andrew.schofield, bkearney, dhlavacd, kabbott, mhulan, sokeeffe |
Target Milestone: | Unspecified | Keywords: | FutureFeature, Triaged, UserExperience |
Target Release: | Unused | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2020-09-30 13:41:04 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Karl Abbott
2018-11-16 20:37:30 UTC
If you need to have user access revoked, you need to remove the user account. Changing password seems like some workaround. That would even be impossible for users with external auth source. Also that wouldn't invalidated API tokens that could still be used. Note that even after account deletion, all audits remains untouched if some later investigation of user activity is needed. What prevents customer from simply removing the user account? Would that solve this case? From customer: "In this specific instance we don't want to have to remove the user. I still feel that the change of a password should invalidate active sessions. I don't find much from google in terms or best practice around this, but certainly one educational / beginners guide for rails and user management does just this." Cheers, Karl Created redmine issue https://projects.theforeman.org/issues/28342 from this bug Thank you for your interest in Satellite 6. We have evaluated this request, and while we recognize that it is a valid request, we do not expect this to be implemented in the product in the foreseeable future. This is due to other priorities for the product, and not a reflection on the request itself. We are therefore closing this out as WONTFIX. If you have any concerns about this, please do not reopen. Instead, feel free to contact Red Hat Technical Support. Thank you |