Live group resolution: membership changes should apply without re-login #96
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Follow-up to #94 (route A decided 2026-08-03: spaces broker to the IdP). Sequenced by Nikola: tackle after #95.
The v1 trade being fixed: OIDC group membership rides in the session (memory-only, 12h TTL), so when a space owner grants someone access, the new member only sees the space at their next login/session refresh — same lag for revocations, which is also a (bounded) security window: a removed member keeps access until their session ends.
Direction: resolve groups live instead of (or layered over) the session snapshot — e.g. the scope decorator consults a short-TTL per-user group cache populated via the Keycloak Admin API (the
cairn-keycustodyservice account already reads users and groups for key custody), refreshing every 1–5 minutes or on 403-style misses. LDAP mode already resolvesmemberOfat bind time, so its staleness window is the Basic-auth fingerprint cache — review both paths together.Design points to settle at implementation time: cache TTL vs. Admin API load; whether revocation should additionally invalidate live sessions; keeping the no-IdP fallback (local auth) unaffected.
Shipped in v0.3.28 (PR #99), live on .249 — startup log confirms
live group resolution enabled (#96).auth.WithLiveGroupsre-resolvesUser.Groupsper request through the Keycloak Admin API (samecairn-keycustodyclient, 60s cache). Grants apply within a minute; revocations too — the removed-member window shrinks from session lifetime (12h) to cache TTL. Sits under the admin-flag evaluation, so adding/removing someone fromcairn-adminsalso applies live. IdP outage → session snapshot stands, 30s negative cache. App-password requests covered; LDAP unchanged (resolves memberOf at bind; its staleness is the credential-cache window, documented).Dogfood check: create a space, add a second user, and have them refresh (no re-logout) after ~1 minute — the space should appear. Remove them and their access should vanish within a minute too.