Bug #25469: Users from external providers manage to log in but their session is invalidated instantly - Rudder - Issue Tracker

Actions

Copy link

Bug #25469

open

Users from external providers manage to log in but their session is invalidated instantly

Added by Clark ANDRIANASOLO 14 days ago. Updated 11 days ago.

Status:

Pending release

Priority:

N/A

Assignee:

François ARMAND

Category:

Security

Target version:

8.1.7

Pull Request:

https://github.com/Normation/rudder/p...

Severity:

Critical - prevents main use of Rudder | no workaround | data loss | security

UX impact:

I hate Rudder for that

User visibility:

First impressions of Rudder

Effort required:

Small

Priority:

187

Name check:

To do

Fix check:

Checked

Regression:

Description

After installing the auth-backends plugin, I could log in using OIDC, but I directly get a log that my session is invalidated (since the parent ticket implementation) :

2024-09-13 13:16:40+0000 INFO  application.authorization - Principal 'me@example.com' role list extended with OIDC provided roles: [rudder_admin(administrator)] (override: true)
2024-09-13 13:16:40+0000 INFO  application - Rudder authentication attempt for principal 'me@example.com' with backend 'oidc': success
2024-09-13 13:16:40+0000 INFO  application - User session for user 'me@example.com' is invalidated because : user is unknown

OIDC and LDAP users from external providers session should be treated the same as file users

Subtasks 2 (2 open — 0 closed)