Repository navigation
OpenID Connect links: remove one in the panels, and stop using them when the identity provider changes - #913
Merged
Conversation
…hen the identity provider changes - Customers > Info: an external sign-in row can be deleted (Admin and Store panels, within the panel's scope); removing an OpenID Connect link also ends the customer's sessions started at the provider. - The store records the provider the links were made with (OidcLinkSettings; the first use adopts the configured Authority). After OidcResourceServer:Authority changes, provider sign-in, access tokens and new links are refused and an error is logged, until an administrator removes the links (another provider) or keeps them (the same provider at a new address) in Configuration > External authentication. A subject is unique only within one provider, so a stored link must never select an account for a user of another provider.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| private void LogMismatch(string linkedAuthority) | ||
| { | ||
| var now = DateTime.UtcNow.Ticks; | ||
| var last = Interlocked.Read(ref _lastMismatchLogTicks); |
…and bulk session end - Token revocations live in their own collection (OidcTokenRevocation, keyed by a hash of the subject), so removing a link no longer brings revoked access tokens back - Without any OpenID Connect link the configured Authority is adopted; links whose provider was never recorded are refused until reviewed instead of being adopted silently - Recording the provider is serialized per instance and skipped while no Authority is configured - While the links belong to another provider: provider sessions are not used or revalidated, back-channel logout ends no session (it still revokes the subject's tokens), and SsoOnly keeps the password - EndAllOpen ends every open session with one update and one cache prefix removal - Link counts use CountAsync/AnyAsync; Remove/Keep links require a configured resource server - The customer tab lists OpenID Connect links without the sign-in plugin
| var now = DateTime.UtcNow.Ticks; | ||
| var last = Interlocked.Read(ref _lastMismatchLogTicks); | ||
| if (now - last < TimeSpan.FromMinutes(5).Ticks || | ||
| Interlocked.CompareExchange(ref _lastMismatchLogTicks, now, last) != last) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves: no issue (follow-up to the OpenID Connect work, #891-#910)
Type: feature
Issue
Two gaps around the stored links between customers and identities at the OpenID Connect provider (
ExternalAuthentication,ExternalAuth.OpenIdConnect):ProviderOnlythe customer cannot remove the connection, and the panels only listed it. The guide told administrators to delete the document in the database.OidcResourceServer:Authoritykept using the old links. Asubis unique only within one provider. After switching to another provider or realm (or connecting a copy of the production database to a test provider), a subject of the new provider equal to a stored one selected another person's account. Providers that number their users (1,2, ...) make that likely. The guide only said to remove the links first, without saying how.Solution
Editpermission, within the panel's scope throughLoadAuthorizedCustomer). Removing an OpenID Connect link also ends the customer's provider sessions (IOidcSessionService.EndByCustomer, end reasonLinkRemoved). The next provider sign-in connects the account again by the rules of a first sign-in.The store records the provider the links were made with in
OidcLinkSettings(store-independent). The first use adopts the configuredAuthority, so existing installations keep working. Trailing slash and case are ignored.When
Authoritydiffers,OidcCustomerResolverrefuses provider sign-in (OidcLoginRefusal.ProviderChanged, with its own text on the plugin's failure page), access tokens (403) andLinkIdentity(OidcLinkResult.ProviderChanged). An error is logged at most once in five minutes.Configuration > External authentication gets an OpenID Connect account links card, shown while the resource server is enabled. It shows the provider and the number of links, reports a change, and offers:
Both buttons ask for confirmation.
IOidcLinkService/OidcLinkServicehold this logic.OidcSessionServicegetsEndByCustomerandEndAllOpen.DefaultLanguage.xmlandUpgrade/en_250.xml; the plugin'sFailed.ProviderChangedin the plugin's list (the plugin is new in 2.5).Tests:
OidcLinkServiceTests: adoption, same provider with trailing slash and case, change, state, remove all, keep, remove one, another customer's link refused.LinkIdentityrefused after a change.OidcSessionServiceTests:EndByCustomer,EndAllOpen.BaseCustomerControllerTests: unlink within scope; out of scope throws and removes nothing.Verified end to end on a running copy (
ProviderOnly, Keycloak 26.8 and Zitadel v4.19):Authorityto Zitadel:/oidc/failed?reason=7, the browser stays a guest) and the error was logged;Breaking changes
IOidcSessionServicehas two new members (EndByCustomer,EndAllOpen), andOidcCustomerResolvertakesIOidcLinkServicein its constructor. Both are unreleased indeveloponly.Authorityafter this release must confirm the links in Configuration > External authentication before provider sign-in works again.