Add logout other sessions checkbox to TOTP, webauthn and recovery authn codes setup pages #21897
Conversation
…hn codes setup pages Closes keycloak#10232
|
@rmartinc Looks great, Thanks! My vote would be to just add this to UpdateEmail action as well as it should be covered as well. |
|
@mposolda Adding the checkbox to the update email was not so direct as I thought. It seems that if the email needs to be verified in the realm, it needs to be verified at change too (ensuring I'm the owner of the previous email). So there is a second case in which the logout sessions should be postponed to the time when the email is verified (I think it makes no sense doing the logout before when the email is sent). I have created a second commit instead of squashing the PR, I think it's easier to review this way. I can do it different if you think this is not the best option, or we can just remove the email part (second commit). CI worked yesterday in my branch. |
…hn codes setup pages (keycloak#21897) * Add logout other sessions checkbox to TOTP, webauthn, recovery authn codes setup pages and to update-email page Closes keycloak#10232
|
@mposolda May I ask here if the offline session token are invalidated as well? |
|
@moritzschmitz-oviva I would say that no, the method that is called is getUserSessionsStream, not getOfflineUserSessionsStream to obtain the sessions to logout. |
Was there a reason to not also invalidate them? |
Closes #10232
Main points:
login-recovery-authn-code-config.ftlhas been modified a bit to make both check-boxes (the previous confirmation box and the new logout other sessions input) look the same.logoutOtherSessionsif the form parameterlogout-sessionsis passed toon.BackwardsCompatibilityUserStorageTestneeds changes because it registers totp with a session created before. So the test failed as the previous sessions was removed now.@mposolda I have not modified the update email action as it was mentioned this way in the issue. But we can do the same for that action. The new account console also uses an AIA to update the user email, so I think it would be exactly the same.