Hide Forgot
Description of problem: Openshift allows a user to log into the system an unlimited numbfer of times. Openshift should limit the number of logins that are allowed for a given user, both within the CLI and the web interface. Ideally Openshift should limit the number of OAuth tokens that can be simultaneously issued to a given identity as well as the number of web sessions allowed from a given identity. It should allow the number of simultaneous tokens/web sessions to be limited by the user group (ideally a max of 3 for non-adminstrator users and 2 for administrative user) or identity. This is a requirement of NIST 800-53 AC-10. Version-Release number of selected component (if applicable): OCP 3.3 How reproducible: Perfectly. Steps to Reproduce: 1. Access the web interface of an OCP cluster configured via default settings, using multiple browsers/tabs. 2. Access is allowed in all sessions. Actual results: Access is allowed in all sessions. Expected results: The user should be denied access (perhaps redirected to an error page) if too many token/sessions are currently active; or access may be allowed and the oldest token/session should expire. Additional info:
This is something we may not be able to do, unless it is limited to just the web console, is that the case.
With the introduction of OpenShift 4, Red Hat has delivered or roadmapped a substantial number of features based on feedback by our customers. Many of the enhancements encompass specific RFEs which have been requested, or deliver a comparable solution to a customer problem, rendering an RFE redundant. This bz (RFE) has been identified as a feature request not yet planned or scheduled for an OpenShift release and is being closed. If this feature is still an active request that needs to be tracked, Red Hat Support can assist in filing a request in the new JIRA RFE system, as well as provide you with updates as the RFE progress within our planning processes. Please open a new support case: https://access.redhat.com/support/cases/#/case/new Opening a New Support Case: https://access.redhat.com/support/cases/#/case/new As the new Jira RFE system is not yet public, Red Hat Support can help answer your questions about your RFEs via the same support case system.