oauthclientauthorizations are not repeared or GC'd

[enj]

If the client or user no longer exists, the oauthclientauthorization should be deleted.

[abstractj]

@enj wise Mo. When you get the chance, could you provide the steps to reproduce it? Even if you're going to work on it, I'd like to see the issue.

[enj]

1. oc cluster up or equivalent
2. Go to web console and login as developer
3. Create new project foo
4. Create Jenkins + OAuth
5. Once Jenkins is ready, log into Jenkins as developer using OAuth
6. Using oc as system:admin, observe that an oauthclientauthorization object is created
7. In the web console as developer, delete project foo
8. Use oc to see the now dangling oauthclientauthorization (try to update its scope and it will complain about a missing client)

[abstractj]

@enj I managed to reproduce all the steps you mentioned, except the number 8. I couldn't find any docs about how to update oauth scope using oc client.

Would you say that this issue is somewhat related with your comment here openshift/openshift-docs#3404 (comment)? Because delete is not working.

I did exactly what you mentioned at your comments:

$ oc get oauthclientauthorization -o jsonpath="{range .items[*]}{.metadata.name}{\"\\n\"}{end}" | grep -v '::' | xargs -n 1 echo oc delete oauthclientauthorization
$ oc delete oauthclientauthorization developer:system:serviceaccount:foo:jenkins
$ oc get oauthclientauthorization
NAME                                          USER NAME   CLIENT NAME                         SCOPES
developer:system:serviceaccount:foo:jenkins   developer   system:serviceaccount:foo:jenkins   user:info,user:check-access

[enj]

@abstractj the functionality mentioned in openshift/openshift-docs#3404 (comment) has not been implemented yet, see #11909

To reproduce 8 all you need to do is oc edit oauthclientauthorization <name> and then edit the scope slice with extra data.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[enj]

/lifecycle frozen

[enj]

/unassign

@stlaz @sttts @mfojtik