Comments (5)
Perfect! So quick, thanks! You can close this one.
from mokey.
I've looked at the browser storage and the mokey-sessck is only set when doing login directly on mokey interface (https://login.server/auth/login), not if validating through hydra (https://login.server/oauth/login?challenge...), neither if bypassing hydra.
So, at logout, mokey cookie just doesn't exist. I think this is a bug.
from mokey.
@jvinolas thanks for the report. This may or may not be related to your issue. But there was definitely a bug in the logout/revoke session handling in mokey. This has been fixed in f8c8e35. The error was:
level=warning msg="Logout - Failed to revoke hydra authentication session" error="response status code does not match any response statuses defined for this endpoint in the swagger spec (status 502): {}"
The way the current logout/revoke works in mokey is that it assumes you're running hydra and mokey on the same server. It also assumes you're running the hydra administrative API endpoint (port 4445) bound to localhost with fake-tls-termination enabled. When a user signs out, mokey makes an admin API request to hydra to destroy all sessions for that user. In this case there is no need to implement the user logout flow.
from mokey.
Sorry, I did not explain well. I'm using freeipa+mokey+hydra in a docker-compose, all in the same internal network (what it is almost the same as having it in the same host).
Validation is going correctly from my client apps (moodle/nextcloud) but when I go to logout from any app it fails:
level=warning msg="Logout - Failed to revoke hydra authentication session" error="No sid or user found in session"
Even with the fake-tls-termination enabled. When I logout from apps they redirect to /auth/logout, but as you can see from the code and from the error, mokey is trying to guess the user id from mokey-sessck cookie that was not set on login. I've checked that the mokey-sessck is not being set when doing this login flow through hydra but correctly set if not using oauth at all (validating in mokey with basic auth, not from app/hydra).
from mokey.
@jvinolas Thanks so much for the additional details. Think I got this fixed up. Can you test? Let me know and I'll close this out.
from mokey.
Related Issues (20)
- Change notifications
- timestamp
- failed to set auth types to otp HOT 2
- Add better docs on configuration settings HOT 2
- new account verify by the admin HOT 4
- Bug: Request Header Fields Too Large
- Feature request: Allow users to set an avatar
- OTP NotBefore should use UTC time HOT 1
- Disabled tokens always show up as enabled HOT 2
- css customization HOT 2
- Password reset prompt for expired password fails HOT 1
- "Unencrypted connection" when sending email with TLS off HOT 1
- Allow setting custom TLS ciphers HOT 2
- Add Kerberos Ticket Granting Ticket option
- Questions related to mokey
- where to obtain gpg pubkey used to sign deb and rpm? HOT 2
- QA: Is it possible to integrate Mokey with Keycloak as hydra?
- Turning on OTP does not work HOT 1
- Form fails with "Invalid CSRF token in POST request" HOT 2
- Cannot reset password for admin users
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from mokey.