influxdata / influxdata/influxdb

Deleting a user interacting with tokens

Open
#22,708 1 comment 0 reactions 0 assignees View on GitHub
area/auth kind/bug
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.

1. Create a new influxdb user
2. Create a token for that user
3. Delete the user
4. List tokens
5. Use the token from the deleted user

__Expected behavior:__
Not sure. Either the token should still be valid, or the token should be completely deleted

__Actual behavior:__
In OSS at least, the token is not deleted. But, when we try to list tokens or use the token, we get errors in the logs because the token refers to a user that does not exist.

The token for the deleted user is not listed, and the logs show:

```
Failed to get user {"log_id": "0XJWMq_0000", "userID": "085380936b573000", "error": "user not found"}
Failed to create auth response {"log_id": "0XJWMq_0000", "handler": "getAuthorizations"}
```

Trying to use the token gives:

```
Error: could not find authorization with given parameters: 403 Forbidden: User is inactive
```

`influxd recovery auth list` shows that the token is still present in the database though.

__Environment info:__

* System info: Darwin 20.6.0 x86_64
* InfluxDB version: InfluxDB dev (git: 05e6dc65c5) build_date: 2021-10-20T14:15:20Z

Contributor guide

Open the contributing guide

Research direction

Reproduce the sequence of creating a user and token, deleting the user, listing tokens, and using the token; also inspect the output of `influxd recovery auth list`. Trace the user-deletion and token authorization paths, then establish the intended behavior and cover the resulting handling of tokens whose user no longer exists.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authentication, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.