Understanding token invalidation delay after logout in OpenShift

Updated -

After logging out of the OpenShift Console or CLI, a user's session token can remain valid for a short time in the Red Hat OpenShift Container Platform 4 environment. This is typically a few seconds up to two minutes. During this brief window, API calls made using the token will still be successful. This behavior, while seemingly counterintuitive, is by design and is mainly related to how token authentication responses are handled.

The root cause

This delay is primarily caused as a result of caching token authentication responses. Although caching is intentional and often beneficial for efficiency, in this particular scenario, it is identified as the root cause of the delays observed.

The role of caching in token invalidation delay

The token invalidation delay after logout is primarily due to how authentication responses are handled. Specifically, the responses are cached, and this caching mechanism is operating as intended.

Token authentication responses are cached to achieve two primary objectives:

  • Reduce the latency experienced by the kube-apiserver, thereby improving its responsiveness to client requests.
  • Significantly decrease the volume of network traffic directed towards the oauth-apiserver.

This caching mechanism is crucial for optimizing the overall performance and scalability of the OpenShift cluster, as it prevents the kube-apiserver from having to repeatedly consult the oauth-apiserver for subsequent authentication requests, if any. By storing validated tokens for a defined period, the system can quickly authenticate subsequent requests without the need for full authentication checks, leading to a more efficient and less resource-intensive operation.

However, users have the ability to manage their OAuth access tokens by listing and deleting those that are no longer required, as highlighted in Listing user-owned OAuth access tokens and Deleting user-owned OAuth access tokens.

The oc delete useroauthaccesstokens <token_name> command allows users to explicitly delete their own OAuth access tokens. This action immediately invalidates the token, logging the user out of all active sessions associated with it.

Comments