Differential D5704

keycloak: Set SSO Session Idle to one week, Session Max to one month
ClosedPublic
Actions

Authored by anlambert on May 6 2021, 2:54 PM.

Details

Reviewers

ardumont

Group Reviewers

Reviewers

Maniphest Tasks

T3272: Authenticated users should be able to browse their save code now requests

Commits

rSPSITE09c766391ec2: keycloak: Set SSO Session Idle to one week, Session Max to one month

Summary

It enables to extend an OpenID Connect refresh token expiration
from 30 minutes to one week.

It means a user does not have to login with his credentials again
during that idle period.

For instance when a user logged in into SWH Web Applications
using a browser, if he visits the website again during that
idle period he will remain connected to his authenticated
session.

Please note that it does not affect user permissions encoded in
OIDC access tokens that are renewed every 5 minutes.

15:40 $ bin/octocatalog-diff --octocatalog-diff-args --no-truncate-details -t staging kelvingrove.internal.softwareheritage.org
Found host kelvingrove.internal.softwareheritage.org
Cloning into '/tmp/swh-ocd.tRNPqiYk/environments/production/data/private'...
done.
Cloning into '/tmp/swh-ocd.tRNPqiYk/environments/staging/data/private'...
done.
*** Running octocatalog-diff on host kelvingrove.internal.softwareheritage.org
I, [2021-05-06T15:41:03.438354 #568859]  INFO -- : Catalogs compiled for kelvingrove.internal.softwareheritage.org
I, [2021-05-06T15:41:03.694366 #568859]  INFO -- : Diffs computed for kelvingrove.internal.softwareheritage.org
diff origin/production/kelvingrove.internal.softwareheritage.org current/kelvingrove.internal.softwareheritage.org
*******************************************
  Keycloak_realm[SoftwareHeritageStaging] =>
   parameters =>
     sso_session_idle_timeout =>
      + 604800
     sso_session_max_lifespan =>
      + 2592000
*******************************************
  Keycloak_realm[SoftwareHeritage] =>
   parameters =>
     sso_session_idle_timeout =>
      + 604800
     sso_session_max_lifespan =>
      + 2592000
*******************************************
  Keycloak_realm[master] =>
   parameters =>
     sso_session_idle_timeout =>
      + 604800
     sso_session_max_lifespan =>
      + 2592000
*******************************************
*** End octocatalog-diff on kelvingrove.internal.softwareheritage.org

Related to T3272

Diff Detail

Repository

rSPSITE puppet-swh-site

Lint

Automatic diff as part of commit; lint not applicable.

Unit

Automatic diff as part of commit; unit tests not applicable.

Event Timeline

anlambert created this revision.May 6 2021, 2:54 PM

Harbormaster completed remote builds in B21337: Diff 20355.May 6 2021, 2:54 PM

anlambert requested review of this revision.May 6 2021, 2:54 PM

anlambert added a reviewer: Reviewers.May 6 2021, 2:54 PM

ardumont accepted this revision.May 6 2021, 2:57 PM

This revision is now accepted and ready to land.May 6 2021, 2:57 PM

Why 6 hours and not, say, 1 week or even 1 month?
It is very common these days to remain connected for that long, and the UX in having to relogin often is a lot worse.

In D5704#144807, @zack wrote:

Why 6 hours and not, say, 1 week or even 1 month?
It is very common these days to remain connected for that long, and the UX in having to relogin often is a lot worse.

You are right, let's go for one week then.

anlambert planned changes to this revision.May 6 2021, 3:07 PM

Update:

Set SSO Session Idle to one week

Set SSO Session Max to one month

This revision is now accepted and ready to land.May 6 2021, 3:39 PM

Harbormaster completed remote builds in B21339: Diff 20357.May 6 2021, 3:39 PM

anlambert retitled this revision from keycloak: Set SSO Session Idle to 6 hours to keycloak: Set SSO Session Idle to one week, Session Max to one month.May 6 2021, 3:41 PM

anlambert edited the summary of this revision. (Show Details)

Closed by commit rSPSITE09c766391ec2: keycloak: Set SSO Session Idle to one week, Session Max to one month (authored by anlambert). · Explain WhyMay 6 2021, 3:57 PM

This revision was automatically updated to reflect the committed changes.

anlambert added a commit: rSPSITE09c766391ec2: keycloak: Set SSO Session Idle to one week, Session Max to one month.