Skip to content

Refresh user info in Rancher

Bogdan Antohe requested to merge auth-user into main

What does this MR do and why?

Reported into issue #1223 (closed), users are facing issues due to connectivity between rancher and keycloak which becomes inactive after one hour. By default rancher has specific mechanism to manage user information defined by following parameters ( auth-user-info-max-age-seconds, auth-user-info-resync-cron, more details about it ca be found on https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups).

By default, rancher has set auth-user-info-max-age-seconds on 3600s and after this period will try to refresh info about users, but in our case when this action is preformed the access token from keycloak is expired ( looking into client details the access token lifespan is 5 min) and will generate errors

[DEBUG] Starting refresh process for u-czzbxnamka
[DEBUG] [generic oidc] getUserInfo: attempting to refresh access token
[ERROR] error syncing 'u-czzbxnamka': handler mgmt-auth-userattributes-controller: oauth2: "invalid_grant" "Token is not active", requeuing

In this MR I changed the approach and I used auth-user-info-resync-cron option to trigger the refresh action in this way we avoid to get an expired token because the process is start more often.

 [DEBUG] Skipping refresh for system-user u-mo773yttt4
 [DEBUG] Skipping refresh for system-user u-b4qkhsnliz
 [DEBUG] Starting refresh process for u-cjfqn
 [DEBUG] Starting refresh process for u-czzbxnamka
 [DEBUG] Skipping refresh for system-user u-dkn6gy74rj
 [DEBUG] Skipping refresh for system-user u-iznqbkgp77
 [DEBUG] Finished refresh process for user-vbnjx
 [DEBUG] Finished refresh process for u-cjfqn
 [DEBUG] [generic oidc] getUserInfo: getting user info
 [DEBUG] Finished refresh process for u-czzbxnamka

Related reference(s)

Closes #1223 (closed)

Test coverage

Edited by Bogdan Antohe

Merge request reports