Users that are deleted or deactivated can stay logged in in folio until their token expires (=for a VERY long time)
Description
CSP Request Details
CSP Rejection Details
Potential Workaround
Attachments
- 06 Dec 2019, 09:19 PM
clones
is blocked by
Checklist
hideTestRail: Results
Activity
Cate Boerema December 9, 2019 at 10:42 AM
Hi @patty.wanninger. If you have a bug fix or story that requires more work, the correct process is to leave a comment describing what is not working and put the issue back into In progress.
That said, in this particular case, I think we should probably accept the fix as-is. We are long past the module release deadline and this fix prevents inactive users from working in FOLIO. If your user is deactivated while logged in, FOLIO becomes unusable. The error messages aren't pretty but you really can't do much. Once logged out, you can't log back in again.
If you think we need better error messages in this case, I think we should file a new issue for that. It would be great if you could be specific about what the error messages should say and what scenarios to cover. Thanks much!
patty.wanninger December 6, 2019 at 9:25 PM
@Hongwei Ji - BUT - when I try to open folio-snapshot.aws.indexdata.com in the Firefox browser, having NOT signed out of my patron, but just x-ing the browser window, when I try that address again, I get a blank screen for about a minute and then the message "Error:server is down."
patty.wanninger December 6, 2019 at 9:22 PM
I tested this and the patron is inactivated, with this message:
The user stays logged in on the screen. However, clicking any app gives you an error - "Could not retrieve configuration information."
So not super-elegant, but does the trick.
Ann-Marie Breaux December 6, 2019 at 7:06 PM
@patty.wanninger This is showing up in the manual testing queue - do you want to test it? Thank you!
Hongwei Ji December 2, 2019 at 1:53 PM
@Cate Boerema, by default it is 1 minute (to re-check if the user in the token is still active).
Details
Details
Assignee
Reporter
Priority
P2
Overview:
It seems that the login functionality does neither take user deletion or deactivation status into consideration after the login has happened, leading to very long log-in sessions for users that should have lost their access to FOLIO.
Steps to Reproduce:
Using one browser, login to FOLIO wit user account A.
Using another browser logged in as another user with the right permissions or by using an API call, either remove the user from FOLIO, or deactivate the user.
Expected Results:
The first browser session is terminated or the user is prevented from performing actions in FOLIO afer a short ammount of time.
Actual Results:
The user may stay logged in for months.