This repository was archived by the owner on May 27, 2024. It is now read-only.
This repository was archived by the owner on May 27, 2024. It is now read-only.
Once a graylog session exists, the user name is not checked on subsequent requests if SSO user name has changed #35
Description
Problem description
Steps to reproduce
Experienced Behavior
- Log in to Graylog using SSO
- Log out of SSO provider and log in with a different user
- Open Graylog URL -> the session of the old user is still active
- Manual Logout of the old user -> a new session for the new user is created.
Expected Behavior
- Log in to Graylog using SSO
- Log out of SSO provider and log in with a different user
- Open Graylog URL -> the previous session should be terminated automatically as new user name in http header doesn't match the sessions old user name.
- A new session should be created automatically for the new user.
Environment
- Graylog Version: 2.4.3
- Plugin Version: 2.4.2 with PR Add sync user roles by http header #25 merged
- Elasticsearch Version: not relevant
- MongoDB Version: not relevant
- Operating System: not relevant
- Browser version: not relevant