Rh-che: Logout is not working on che.openshift.io

[rhopp]

Trying to logout from che.openshift.io in dashboard (bottom left corner) is not working.
It just redirects user to:

Watching network communication in browser, one will notice return code 400 for this request:
https://developers.redhat.com/auth/realms/rhd/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fche.openshift.io%2Fdashboard%2F

This isn't working on prod-preview either.

[ibuziuk]

was able to repro, looks important...

[ibuziuk]

Added to prio doc for the next sprint

[ibuziuk]

@rhopp against which user you was able to reproduce this issue ?

[ibuziuk]

looks like this is not user-specific. @davidfestal maybe you have some ideas?

[davidfestal]

it seems to me that the redirect_uri that that is passed to the developers.redhat.com logout endpoint by fabric8_auth is not the good one.

@alexeykazakov any idea of any change that would have occured in the logout endpoint of fabric8_auth ?

[alexeykazakov]

We have switched to developers.redhat.com sso (we do not use sso.openshift.io Keycloak anymore) sometime ago. It means we could lose some valid redirects during this transition.
che.openshift.io is not among valid redirects in RHD (it was in our KC). We will need to add this to RHD.
@davidfestal could you please create a JIRA for the RHD folks to add https://che.openshift.io/* and https://che.prod-preview.openshift.io/* to the corresponding RHD clients? See https://issues.jboss.org/browse/MWES-2945 as an example of such request.
Also, we actually implemented a new version of logout endpoint in auth service. Che should really switch to that v2 endpoint for logout. Sorry, we forgot that che also using logout and didn't notify you about that change:

• http://swagger.goa.design/?url=github.com%2Ffabric8-services%2Ffabric8-auth%2Fdesign#!/logout/logout_logoutv2
• https://github.com/fabric8-services/fabric8-auth/pull/746
• https://github.com/fabric8-ui/fabric8-ui/pull/3513 (this is a PR to OSIO UI with some details about how the new logout v2. endpoint works)

@sbryzak can help you if you have questions and also @rohitkrai03 can help if you have any questions about how it should be implemented in UI.

[alexeykazakov]

could you please create a JIRA for the RHD folks

@davidfestal I've created an issue in JIRA for that - https://issues.jboss.org/browse/MWES-3030
But please also move to logout v2.

[ibuziuk]

@alexeykazakov thanks a lot for your input, it is probably makes sense to take logout v2 issue to the next sprint @l0rd wdyt?

[ibuziuk]

just discussed with @alexeykazakov that switching to logout v2 is not critical, but really-really nice to have. So, we could probably postpone the switch for 1- 2 sprints but should take it in mind during prio sessions.

[l0rd]

@ibuziuk I am ok to add it to this sprint if you have capacity

[ibuziuk]

@l0rd I suppose we have capacity only for fixing logout issue, but not for switching to logout v2 - https://github.com/redhat-developer/rh-che/issues/1298 which is going to be postponed in this sprint

[ibuziuk]

@Katka92 @ScrewTSW could you please confirm that the problem is not reproducible against prod-preview?

[ScrewTSW]

@Katka92 @ScrewTSW could you please confirm that the problem is not reproducible against prod-preview?

che.prod-preview.openshift.io logout works for me without any issues.
EDIT: Strangely I am not able to reproduce that on production either. the logout buttons work fine for me

[ibuziuk]

@alexeykazakov I do not have access to https://issues.jboss.org/browse/MWES-2945 (You can't view this issue). Could you please clarify why logout still works fine on prod-preview?

[alexeykazakov]

You can't reproduce it more because https://issues.jboss.org/browse/MWES-3030 is done.
So, the redirect has been fixed. It should now work in both preview and prod.
I think we can close this issue and open a new one for siwtching che.openshift.io to /logout/v2 See https://github.com/redhat-developer/rh-che/issues/1290#issuecomment-473382270 for details.

[ibuziuk]

@alexeykazakov sorry, not following - currently logout works on prod preview and does not work on prod (that is the main issue).
Logout v2 is out of scope for a couple of sprints as we discussed on 1:1 - https://github.com/redhat-developer/rh-che/issues/1290#issuecomment-473395154

Also, I do NOT have access to the issues you are posting:

[1] https://github.com/redhat-developer/rh-che/issues/1298

[ibuziuk]

oh, looks like fixed now

It should not work in both preview and prod

@alexeykazakov I guess you mean it should work ;-)

[ibuziuk]

@Katka92 @ScrewTSW could you please verify before closing?

[alexeykazakov]

I guess you mean it should work ;-)

Yeah.. sorry. Meant "it should NOW work in both preview and prod" :)

[Katka92]

I can verify, working correctly on prod and prod-preview. I think you can close this. :)