Bug 1772026

Summary:	Token does not expire on logout
Product:	Red Hat Satellite	Reporter:	Nikhil Kathole <nkathole>
Component:	Authentication	Assignee:	Rahul Bajaj <rabajaj>
Status:	CLOSED WONTFIX	QA Contact:	Nikhil Kathole <nkathole>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.7.0	CC:	apatel, bkearney, kgaikwad, mhulan, okhatavk, pcreech
Target Milestone:	6.7.0	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	foreman-1.24.1-1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-03 10:41:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1792135, 1792140
Bug Blocks:

Description Nikhil Kathole 2019-11-13 13:32:32 UTC

Description of problem:

Since we use `reset_oidc_session` method now, there is no way that the session will be able to logout of the Foreman.
The session only logout now when the token expires. We need to handle the logout for SSO mechanisms.

Version-Release number of selected component (if applicable):

Satellite 6.7.0 snap 1

How reproducible: always

Steps to Reproduce:
1)Setup RHSSO (keycloak) with satellite 
2) Login via SSO
2) Try to logout.

Actual results:
Session continues.logout doesn't work.

Expected results:
Should logout.

Additional info:

Comment 3 Bryan Kearney 2019-11-13 15:05:37 UTC

Upstream bug assigned to rabajaj

Comment 4 Rahul Bajaj 2019-12-12 15:31:14 UTC

Hello,

Actively working PR can be found here: https://github.com/theforeman/foreman/pull/7245
Logout is working just fine, although a new setting is introduced in the process.

Thanks,

Comment 5 Bryan Kearney 2020-01-09 15:05:23 UTC

Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/28087 has been resolved.

Comment 6 Nikhil Kathole 2020-01-17 07:05:32 UTC

Version tested:
Satellite 6.7 snap 8

Currently the fix of this bugzilla only provides logout URL for OpenID connect users but didn't resolve actual issue. So I have raised the issue explicitly that needs to be handle and blocking verification of this till the fix of https://bugzilla.redhat.com/show_bug.cgi?id=1792135, https://bugzilla.redhat.com/show_bug.cgi?id=1792140

Comment 8 Rahul Bajaj 2020-03-03 10:41:17 UTC

Hello,

Token must not expire on logout as decided. Since we are looking at an SSO functionality, the token will only expire on session expiration. This will be considered as WONTFIX. Closing this issue for now, feel free to open if you fell otherwise.

Thanks,

Comment 9 Rahul Bajaj 2020-03-05 10:04:50 UTC

Clearing out the needinfo as well.