You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
kflynn
changed the title
KubernetesEndpointResolver works with the name endpoint only
KubernetesEndpointResolver works with the name "endpoint" only
May 10, 2019
…essions
[Pen Test] Allow Log Out of All EPC Sessions
Adds a mechanism to invalidate all outstanding JWTs for the Edge Policy Console. The JWT's Subject field holds an optional nonce that must match the nonce stored in Redis.
- The original token from edgectl login does not have the nonce
- This is accepted by the auth check
- This token expires so we don't need to worry about it
- Any user activity refreshes the token, which adds the nonce
- This is _the way_ we refresh tokens; there's no way to avoid this
- The auth check requires this nonce to match the one in redis
- Clearing the nonce in redis causes a new one to be generated
- The new nonce will be different (it's based on the clock)
- So all old tokens will be invalid because the nonce won't match
Also adds a button in the Debugging page to log out of all sessions and an associated endpoint to clear/regenerate the nonce to achieve that.
Describe the bug
KubernetesEndpointResolver
works with the nameendpoint
only. An override doesn't work.To Reproduce
Following configuration doesn't work:
But this works:
Expected behavior
KubernetesEndpointResolver
should work with name override.Versions (please complete the following information):
The text was updated successfully, but these errors were encountered: