You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
What is the bug?
Dashboard security plugin doesn't call refresh token in case id token is expired
How can one reproduce the bug?
Steps to reproduce the behavior:
We are using Gitlab as IDP, where id token life time is 2 minutes. Or any IDP can be used with small token expiration time
Login into Opensearch Dashboard
Wait for > 2 mins
Click any link on the Dashboard-> relogin happens
What is the expected behavior?
Refresh token end point call happens and new id token is used for further request
What is your host/environment?
Opensearch Dashboard image 2.14.0.0
What is the bug?
Dashboard security plugin doesn't call refresh token in case id token is expired
How can one reproduce the bug?
Steps to reproduce the behavior:
We are using Gitlab as IDP, where id token life time is 2 minutes. Or any IDP can be used with small token expiration time
What is the expected behavior?
Refresh token end point call happens and new id token is used for further request
What is your host/environment?
Opensearch Dashboard image 2.14.0.0
Do you have any additional context?
isValidCookie() https://github.com/opensearch-project/security-dashboards-plugin/blob/2.14.0.0/server/auth/types/authentication_type.ts#L145, where refresh token logic is located, is not called any more, because cookie is cleared here https://github.com/opensearch-project/security-dashboards-plugin/blob/2.14.0.0/server/auth/types/authentication_type.ts#L139. And it is cleared because token is expired. Expiration logic was changed recently.
The text was updated successfully, but these errors were encountered: