questdb / questdb/ui

OIDC stays signed with no permissions if user doesn't have HTTP permissions. We should log out on the login screen

Open
#495 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Enterprise web-console
Dominant language
TypeScript
Stars
29
Forks
39
Avg merge
4d 11h
Merged PRs (30d)
4

Description

If I have a OIDC user with no HTTP permissions, when login in I get a blank screen with a login button. The first fix we would need would be telling the user they are not seeing anything because they lack HTTP permissions and should contact their admin.

Other than this, when I click on login, I am taken back to the login screen, but if I try login in now with a questdb user, like admin/quest, rather than with OIDC, I get the blank screen again and logs indicate I don't have permissions, even if from my point of view I seem to be logging in with the admin user.

The problem seems to be we don't do a proper logout when we display the login screen, so if the user with no permissions was logged in, we are still trying to use that one. The only two ways I got to get out of this situation (both not ideal) were:

  • disable OIDC temporarily on the server, so admin user can log in again
  • just grant HTTP to the OIDC user, so we can access web console and click on log out

The web console should do the logout automatically in this case when we detect no HTTP permissions. Also, an error message would be appreciated.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the login screen and the OIDC logout handling in the web console, then reproduce the flow with an OIDC user who lacks HTTP permissions. The change is complete when this case logs the user out automatically, shows an explanatory error, and allows a subsequent QuestDB login.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
authentication, authorization, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.