providers/oauth2: cleanup tokens when user is deactivated #12859
Conversation
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
✅ Deploy Preview for authentik-docs canceled.
|
✅ Deploy Preview for authentik-storybook canceled.
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
✅ All tests successful. No failed tests found. Additional details and impacted files@@ Coverage Diff @@
## main #12859 +/- ##
==========================================
+ Coverage 92.69% 92.75% +0.05%
==========================================
Files 769 769
Lines 38926 38936 +10
==========================================
+ Hits 36083 36115 +32
+ Misses 2843 2821 -22
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
authentik PR Installation instructions Instructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-10ba005df74276c77f78e056e17f829510b025e3
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-10ba005df74276c77f78e056e17f829510b025e3Afterwards, run the upgrade commands from the latest release notes. |
authentik/core/api/users.py
Outdated
| @@ -765,6 +766,8 @@ def partial_update(self, request: Request, *args, **kwargs) -> Response: | |||
| response = super().partial_update(request, *args, **kwargs) | |||
| instance: User = self.get_object() | |||
| if not instance.is_active: | |||
| RefreshToken.objects.filter(session__user=instance).delete() | |||
There was a problem hiding this comment.
This should be in a signal in the oauth2 provider app, as a user might get deactivated through other means (and we shouldn't introduce new direct app dependencies if possible)
There was a problem hiding this comment.
any other places where this signal should be sent from?
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Details
Closes #12858
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make website)