Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SAML/token Concurrent XHR Requests #26744

Closed
kobelb opened this issue Dec 6, 2018 · 4 comments · Fixed by #32565
Closed

SAML/token Concurrent XHR Requests #26744

kobelb opened this issue Dec 6, 2018 · 4 comments · Fixed by #32565
Labels
bug Fixes for quality problems that affect the customer experience Feature:Security/Authentication Platform Security - Authentication Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!

Comments

@kobelb
Copy link
Contributor

kobelb commented Dec 6, 2018

SAML will attempt to use the refresh token to get a new access token when it receives an error denoting that the access token has expired. This workflow works well until there are two concurrent XHR requests occurring at the same time, and only one of these is able to actually use the refresh token while the other request will see an expired access and refresh token.
@kobelb kobelb added bug Fixes for quality problems that affect the customer experience Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! Feature:Security/Authentication Platform Security - Authentication labels Dec 6, 2018
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security

@kobelb
Copy link
Contributor Author

kobelb commented Dec 6, 2018

/cc @epixa is the work that you're performing for the new token provider addressing this limitation, or will we be addressing this separately?

@epixa
Copy link
Contributor

epixa commented Dec 6, 2018

The token provider will have the same limitation.

@epixa epixa changed the title SAML Concurrent XHR Requests SAML/token Concurrent XHR Requests Dec 13, 2018
@epixa
Copy link
Contributor

epixa commented Dec 20, 2018

I've proposed a solution to this problem in elastic/elasticsearch#36872

@kobelb kobelb mentioned this issue Mar 6, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Fixes for quality problems that affect the customer experience Feature:Security/Authentication Platform Security - Authentication Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Reenable auth provider tests kobelb/kibana
3 participants
@epixa @kobelb @elasticmachine