[KNOX-2970] During knox global logout , the corresponding SSO token should be either disabled or revoked

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.1.0
• Component/s: KnoxSSO
• Assignee: Sandor Molnar
• Reporter: J.Andreina
• Created: 18/Oct/23 08:48
• Updated: 19/Oct/23 18:01
• Resolved: 19/Oct/23 18:01

Description

PROBLEM STATEMENT:
During knox global logout , SSO token should be either disabled or removed

BUILDS:
2.0
 
STEPS TO REPRODUCE:

• Enable logout "knox.homepage.logout.enabled" , configure "knox.global.logout.page.url" to "https://*********"
• Access knox home page
• Click on global logout

CURRENT BEHAVIOUR:
the session will be removed and user if need to access knox home page again should relogin , but still the previous SSO token will be alive for default 1 day which can cause security risk

EXPECTED BEHAVIOUR:
During knox global logout , the corresponding SSO token should be either disabled or revoked

Issue Links

• is caused by: KNOX-2961 KnoxSSO Token Invalidation
• links to: GitHub Pull Request #806