If the session is deleted at the OP (e.g. manually deleting a session in the Keycloak Admin UI, not via logout) the session is not deleted at the UMC, which is fine. However we do attempt to refresh the access token on every request to the UMC. This is generally not an issue since it probably doesn't happen that often, it is however annoying during debugging because UMC thinks the session is still active but fails to refresh the access tokens leading to not being able to login. IMO the solution here would be to log the user out and delete the session if the OIDC token refresh fails.
I increased the user pain, because keycloak marks a session as inactive after half an hour of inactivity (can be configured in the realm settings). The refresh token is not accepted for an inactive session, and you get this bug. At that point, the umc is unusable for the user, you only get the login error. Workarounds: - Delete the session cookie - or Wait for the session cookie to expire - or Restart the umc imho none of these are obvious to the average user or a nice user experience.
Relevant error messages: - Keycloak (inactive session) 2024-08-22 15:49:17,174 WARN [org.keycloak.events] (executor-thread-10) type="REFRESH_TOKEN_ERROR", realmId="ucs", realmName="ucs", clientId="https://master.ucs.test/univention/oidc/", userId="null", sessionId="ba2023f4-df82-4bd5-9409-a8fbb918ba10", ipAddress="10.207.175.82", error="invalid_token", reason="Session not active", grant_type="refresh_token", refresh_token_type="Refresh", refresh_token_id="c920229b-d5ec-42ad-9fa8-97475a746ed9", client_auth_method="client-secret" - Keycloak (deleted session) 2024-08-22 14:45:30,661 WARN [org.keycloak.events] (executor-thread-1) type="REFRESH_TOKEN_ERROR", realmId="ucs", realmName="ucs", clientId="https://master.ucs.test/univention/oidc/", userId="null", ipAddress="10.207.175.82", error="invalid_token", reason="Token is not active", grant_type="refresh_token", client_auth_method="client-secret" - UMC (inactive keycloak session) 22.08.24 15:49:16.974 MAIN ( ERROR ) : Could not get new access token: b'{"error":"invalid_grant","error_description":"Session not active"}' - UMC (deleted keycloak session) management-console-server.log:22.08.24 14:52:18.496 MAIN ( ERROR ) : Could not get new access token: b'{"error":"invalid_grant","error_description":"Token is not active"}'
The issue was solved performing a logout when the refresh token failed, that delete the umc session and clean the state. univention-management-console.yaml cafe315f9b0c | Bug #57515: univention-management-console advisory univention-management-console (12.0.35-1) 864567b115e5 | fix(oidc): Logout when session refresh fail due to OP session deleted manually univention-ldap (15.0.0-39) c70f99e8ff52 | Bug #46120 ldap: Removed unused files ucs-test (10.0.23-3) 7aaf0dd99379 | fixup! test(oidc): test session logout with invalid access token ucs-test (10.0.23-2) c86fb34cae4d | docs(ucs-test): Explain how to run specific Playwright test 28e95f6d60b6 | test(oidc): test session logout with invalid access token Package: univention-management-console Version: 12.0.35-1 Branch: 5.0-0 Scope: errata5.0-9 Successful build Package: ucs-test Version: 10.0.23-3 Branch: 5.0-0 Scope: errata5.0-9
OK - univention-management-console.yaml (12.0.35-2)
--------------5.1------------------ univention-management-console (13.0.24) 6e7f2e12a12b | fix(oidc): Logout when session refresh fail due to OP session deleted manually ucs-test (11.0.56) a2e6fe0ccd6a | test(oidc): test session logout with invalid access token Successful build Package: univention-management-console Version: 13.0.24 Branch: 5.1-0 Successful build Package: ucs-test Version: 11.0.56 Branch: 5.1-0 --------------5.2------------------ univention-management-console (14.0.33) 5250b7edc1a9 | fix(oidc): Logout when session refresh fail due to OP session deleted manually ucs-test (12.0.180) a6f4c0378f2d | test(oidc): test session logout with invalid access token Successful build Package: univention-management-console Version: 14.0.33 Branch: 5.2-0 Successful build Package: ucs-test Version: 12.0.180 Branch: 5.2-0
<https://errata.software-univention.de/#/?erratum=5.0x1131>