RocketChat / RocketChat/Rocket.Chat
SSO blocked user are not blocked in rocket.chat
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
SSO blocked user are not blocked in rocket.chat
Steps to reproduce:
- Block user in SSO
- User still use Rocket.Chat until logout
Expected behavior:
RocketChat (in case of Oauth2/OIDC) use refresh token to chek that user not blocked in SSO
Actual behavior:
User still use Rocket.Chat until logout
Server Setup Information:
- Version of Rocket.Chat Server: 3.6.1
- Operating System: from original docker image 3.6.1
- Deployment Method: docker+k8s
- Number of Running Instances: 6
- DB Replicaset Oplog: not matter
- NodeJS Version: from original docker image 3.6.1
- MongoDB Version: 4
Client Setup Information
- Desktop App or Browser Version: not matter
- Operating System: not matter
Additional context
Relevant logs:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the OAuth2/OIDC session flow and its refresh-token handling. Reproduce the reported case by blocking a user in the SSO provider while the Rocket.Chat session remains active. Done means the blocked user is denied access before manually logging out.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100