You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2023/10/18 11:53:00 UTC
[jira] [Work logged] (KNOX-2969) For user-limit to fetch token calculation includes enabled and disabled SSO token count as well, causing failure in generating the JWT token from token gen page
[ https://issues.apache.org/jira/browse/KNOX-2969?focusedWorklogId=885875&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-885875 ]
ASF GitHub Bot logged work on KNOX-2969:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/Oct/23 11:52
Start Date: 18/Oct/23 11:52
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #805:
URL: https://github.com/apache/knox/pull/805
## What changes were proposed in this pull request?
Modified the logic used for calculating the token limit per user in a way such that it ignores the previously generated KnoxSSO cookies. That is, a user can have as many KnoxSSO cookies as they want, but regular tokens are still limited.
## How was this patch tested?
Updated JUnit tests and executed manual testing:
1. Kept the default token limit per user = 10
2. I had three different sessions in different browsers as the `admin` user
3. Disabled one session
4. In one of the remaining sessions generated 10 tokens successfully (please note even the 8th, 9th, and 10th tokens were generated despite the fact I already had 3 KnoxSSO tokens for the same user)
5. The 11th token generation failed as expected
<img width="1779" alt="Screenshot 2023-10-18 at 13 24 10" src="https://github.com/apache/knox/assets/34065904/a670c8d7-c3f6-4eb5-a1d1-37a00a272822">
<img width="1779" alt="Screenshot 2023-10-18 at 13 24 21" src="https://github.com/apache/knox/assets/34065904/8cbbf21e-d092-4e0a-bb83-5b0d9eeff87f">
<img width="1776" alt="Screenshot 2023-10-18 at 13 24 31" src="https://github.com/apache/knox/assets/34065904/1776e8f4-4f11-4a86-8515-7ddb016450a6">
Issue Time Tracking
-------------------
Worklog Id: (was: 885875)
Remaining Estimate: 0h
Time Spent: 10m
> For user-limit to fetch token calculation includes enabled and disabled SSO token count as well, causing failure in generating the JWT token from token gen page
> ----------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-2969
> URL: https://issues.apache.org/jira/browse/KNOX-2969
> Project: Apache Knox
> Issue Type: Bug
> Components: TokenGenerationUI
> Affects Versions: 2.1.0
> Reporter: J.Andreina
> Assignee: Sandor Molnar
> Priority: Major
> Attachments: image-2023-10-18-12-45-37-741.png, image-2023-10-18-12-45-47-121.png, image-2023-10-18-12-46-28-490.png
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> +*{color:#de350b}PROBLEM STATEMENT:\{color}*+
> For token limit on a user calculation includes enabled and disabled SSO token as well, causing failure in generating the JWT token from token gen page
> +*BUILDS:*+
> 2.1.0
>
> +*STEPS TO REPRODUCE:*+
> # Deploy ycloud cluster with above gbn.
> # Configure below from CM UI
> # knox.global.logout.page.url=[https://**********,|https://%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2C/] knoxsso_cookie_management_enabled - enable gateway.knox.token.management.users.can.see.all.tokens = hrt_qa, hrt_1
> # Access knox home page using hrt_22 user
> # Disable the hrt_22 SSO token from hrt_qa token management page
> # Repeat operation 4-5 for 15 times
> # Now login to token generation page using hrt_22 user
> # Generate the jwt token
> +*CURRENT BEHAVIOUR:*+
> Token generation fails saying user limit exceeded , though not even one non-sso token is generated by hrt_22 user
> !image-2023-10-18-12-45-47-121.png|width=1129,height=344!
> !image-2023-10-18-12-46-28-490.png|width=1009,height=285!
> +*EXPECTED BEHAVIOUR:*+
> SSO token should not be considered for per user limit to generate the token calculation .
> Even though we have 15+ SSO tokens (in enabled/disabled state) , user should be able to generate 10 tokens as "gateway.knox.token.limit.per.user" default value is 10
> +*OCCURRENCE:*+
> Reproducible
> +*IMPACT:*+
> If multiple SSO token for user is available then user will not be able to generate jwt token from token generation page
--
This message was sent by Atlassian Jira
(v8.20.10#820010)