[
https://issues.apache.org/jira/browse/KNOX-2778?focusedWorklogId=796923&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-796923
]
ASF GitHub Bot logged work on KNOX-2778:
----------------------------------------
Author: ASF GitHub Bot
Created on: 01/Aug/22 14:41
Start Date: 01/Aug/22 14:41
Worklog Time Spent: 10m
Work Description: MrtnBalazs opened a new pull request, #615:
URL: https://github.com/apache/knox/pull/615
## What changes were proposed in this pull request?
`ConcurrentSessionVerifier` is changed to be used and initilaized like a
service, because initializing it in `GatewayServer` `main()` felt out of place.
It is also modified to store the tokens issued at login so the expiry can be
tracked since we don t have an event to subscribe to when the tokens expire.
The verifier was put in `WebSSOResource` and `WebSSOutResource` to count the
issued tokens when logged in or out.
## How was this patch tested?
I tested it manually by configuring `gateway-site.xml` and logging in and
out from different browsers.
Configuration:
```
<property>
<name>gateway.non.privileged.users</name>
<value>tom,guest</value>
</property>
<property>
<name>gateway.privileged.users</name>
<value>admin</value>
</property>
<property>
<name>gateway.privileged.users.concurrent.session.limit</name>
<value>2</value>
</property>
<property>
<name>gateway.non.privileged.users.concurrent.session.limit</name>
<value>1</value>
</property>
```
Issue Time Tracking
-------------------
Worklog Id: (was: 796923)
Remaining Estimate: 0h
Time Spent: 10m
> Enforce concurrent session limit in KnoxSSO
> -------------------------------------------
>
> Key: KNOX-2778
> URL: https://issues.apache.org/jira/browse/KNOX-2778
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 2.0.0
> Reporter: Sandor Molnar
> Assignee: Balazs Marton
> Priority: Major
> Fix For: 2.0.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Once, KNOX-2777 is ready, the next step is to wire that verifier
> implementation into the KnoxSSO flow such as it throws an authorization error
> (FORBIDDEN; 403) when a user tries to log in to UIs (both Knox's own UIs or
> UIs proxied by Knox) but that user exceeds the configured concurrent session
> limit.
> Basic logout handling should be covered too:
> * manually clicking on the logout button
> * subscribing to a session timeout event (you may want to talk to [~smore]
> about this)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
