owncloud / owncloud/android

[QA] no logout from identity provider possible

Open
#3,872 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Kotlin
Stars
4.2k
Forks
3.1k
Avg merge
1d 12h
Merged PRs (30d)
7

Description

See with android App version ownCloud release Version 3.0.1 (5e553f078)

Actual behaviour
  • I have an owncloud server that requires login via keycloak idp (using the server openidconnect app version 2.2.0-rc.1)
  • Connect android app with the server, the IDP broweser window opens, I can choose a user and log in. OK
    grafik
  • Use the trashcan icon to delete the account again.
  • Connect again (without waiting more than 10 minutes)
    • The IDP immediately authorizes the app, without showing a user password dialog. BAD
    • There is no way to choose a differnet user for this server. BAD.
  • Wait 10 Minutes. Connect to the same server again.
    • A message appears saying my token is expired, I need to log in.
      photo_2023-01-24_19-13-26

  • Click "Einloggen" (log in). The app refreshes, again without asking for username or password and files are now accessible for the original user.
    photo_2023-01-24_19-13-33

  • Note, that the expired message remains at the bottom of the screen, and upload does not work. BAD.
  • have to click "Einloggen" again. After that, the message is gone and upload works. Okayish
Tell us what should happen.
  • when the account is removed, it should also be logged out from the IDP, so that any remainng session tokens are invalidated.
  • it should always be possible to choose the username, after entering a server URL.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Android app flow with a server using Keycloak and the server OpenID Connect app: add an account, remove it, reconnect within 10 minutes, and retry after token expiry. Check the account-removal and login flows for IDP session handling and expired-token state. Done means removing an account invalidates the remaining IDP session, users can choose a username on reconnect, and the expired message does not block uploads after login.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.