{"action":"created","issue":{"url":"https://api.github.com/repos/rancher/rancher/issues/17067","repository_url":"https://api.github.com/repos/rancher/rancher","labels_url":"https://api.github.com/repos/rancher/rancher/issues/17067/labels{/name}","comments_url":"https://api.github.com/repos/rancher/rancher/issues/17067/comments","events_url":"https://api.github.com/repos/rancher/rancher/issues/17067/events","html_url":"https://github.com/rancher/rancher/issues/17067","id":390329493,"node_id":"MDU6SXNzdWUzOTAzMjk0OTM=","number":17067,"title":"Reverify user's groups and their access with provider on an interval","user":{"login":"maxkorp","id":1302526,"node_id":"MDQ6VXNlcjEzMDI1MjY=","avatar_url":"https://avatars1.githubusercontent.com/u/1302526?v=4","gravatar_id":"","url":"https://api.github.com/users/maxkorp","html_url":"https://github.com/maxkorp","followers_url":"https://api.github.com/users/maxkorp/followers","following_url":"https://api.github.com/users/maxkorp/following{/other_user}","gists_url":"https://api.github.com/users/maxkorp/gists{/gist_id}","starred_url":"https://api.github.com/users/maxkorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maxkorp/subscriptions","organizations_url":"https://api.github.com/users/maxkorp/orgs","repos_url":"https://api.github.com/users/maxkorp/repos","events_url":"https://api.github.com/users/maxkorp/events{/privacy}","received_events_url":"https://api.github.com/users/maxkorp/received_events","type":"User","site_admin":false},"labels":[{"id":824123057,"node_id":"MDU6TGFiZWw4MjQxMjMwNTc=","url":"https://api.github.com/repos/rancher/rancher/labels/area/authentication","name":"area/authentication","color":"fbca04","default":false},{"id":824122927,"node_id":"MDU6TGFiZWw4MjQxMjI5Mjc=","url":"https://api.github.com/repos/rancher/rancher/labels/area/rbac","name":"area/rbac","color":"fbca04","default":false},{"id":1040762509,"node_id":"MDU6TGFiZWwxMDQwNzYyNTA5","url":"https://api.github.com/repos/rancher/rancher/labels/team/az","name":"team/az","color":"f9d0c4","default":false},{"id":659821934,"node_id":"MDU6TGFiZWw2NTk4MjE5MzQ=","url":"https://api.github.com/repos/rancher/rancher/labels/version/2.0","name":"version/2.0","color":"e99695","default":false}],"state":"open","locked":false,"assignee":{"login":"maxkorp","id":1302526,"node_id":"MDQ6VXNlcjEzMDI1MjY=","avatar_url":"https://avatars1.githubusercontent.com/u/1302526?v=4","gravatar_id":"","url":"https://api.github.com/users/maxkorp","html_url":"https://github.com/maxkorp","followers_url":"https://api.github.com/users/maxkorp/followers","following_url":"https://api.github.com/users/maxkorp/following{/other_user}","gists_url":"https://api.github.com/users/maxkorp/gists{/gist_id}","starred_url":"https://api.github.com/users/maxkorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maxkorp/subscriptions","organizations_url":"https://api.github.com/users/maxkorp/orgs","repos_url":"https://api.github.com/users/maxkorp/repos","events_url":"https://api.github.com/users/maxkorp/events{/privacy}","received_events_url":"https://api.github.com/users/maxkorp/received_events","type":"User","site_admin":false},"assignees":[{"login":"maxkorp","id":1302526,"node_id":"MDQ6VXNlcjEzMDI1MjY=","avatar_url":"https://avatars1.githubusercontent.com/u/1302526?v=4","gravatar_id":"","url":"https://api.github.com/users/maxkorp","html_url":"https://github.com/maxkorp","followers_url":"https://api.github.com/users/maxkorp/followers","following_url":"https://api.github.com/users/maxkorp/following{/other_user}","gists_url":"https://api.github.com/users/maxkorp/gists{/gist_id}","starred_url":"https://api.github.com/users/maxkorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maxkorp/subscriptions","organizations_url":"https://api.github.com/users/maxkorp/orgs","repos_url":"https://api.github.com/users/maxkorp/repos","events_url":"https://api.github.com/users/maxkorp/events{/privacy}","received_events_url":"https://api.github.com/users/maxkorp/received_events","type":"User","site_admin":false},{"login":"sangeethah","id":4266958,"node_id":"MDQ6VXNlcjQyNjY5NTg=","avatar_url":"https://avatars0.githubusercontent.com/u/4266958?v=4","gravatar_id":"","url":"https://api.github.com/users/sangeethah","html_url":"https://github.com/sangeethah","followers_url":"https://api.github.com/users/sangeethah/followers","following_url":"https://api.github.com/users/sangeethah/following{/other_user}","gists_url":"https://api.github.com/users/sangeethah/gists{/gist_id}","starred_url":"https://api.github.com/users/sangeethah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sangeethah/subscriptions","organizations_url":"https://api.github.com/users/sangeethah/orgs","repos_url":"https://api.github.com/users/sangeethah/repos","events_url":"https://api.github.com/users/sangeethah/events{/privacy}","received_events_url":"https://api.github.com/users/sangeethah/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/rancher/rancher/milestones/140","html_url":"https://github.com/rancher/rancher/milestone/140","labels_url":"https://api.github.com/repos/rancher/rancher/milestones/140/labels","id":3588413,"node_id":"MDk6TWlsZXN0b25lMzU4ODQxMw==","number":140,"title":"v2.2","description":"","creator":{"login":"deniseschannon","id":11410997,"node_id":"MDQ6VXNlcjExNDEwOTk3","avatar_url":"https://avatars1.githubusercontent.com/u/11410997?v=4","gravatar_id":"","url":"https://api.github.com/users/deniseschannon","html_url":"https://github.com/deniseschannon","followers_url":"https://api.github.com/users/deniseschannon/followers","following_url":"https://api.github.com/users/deniseschannon/following{/other_user}","gists_url":"https://api.github.com/users/deniseschannon/gists{/gist_id}","starred_url":"https://api.github.com/users/deniseschannon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deniseschannon/subscriptions","organizations_url":"https://api.github.com/users/deniseschannon/orgs","repos_url":"https://api.github.com/users/deniseschannon/repos","events_url":"https://api.github.com/users/deniseschannon/events{/privacy}","received_events_url":"https://api.github.com/users/deniseschannon/received_events","type":"User","site_admin":false},"open_issues":236,"closed_issues":262,"state":"open","created_at":"2018-08-21T21:05:07Z","updated_at":"2019-01-03T22:54:05Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2018-12-12T17:24:35Z","updated_at":"2019-01-03T23:33:47Z","closed_at":null,"author_association":"COLLABORATOR","body":"The goal of this feature is to ensure that a user's access and group membership stays up to date when they are using API keys they previously created or the kubeconfig that we generate for them.\r\n\r\nShould happen on-demand but out-of-band from an API request. Meaning the flow should be this:\r\n\r\nUser creates one or more tokens and makes requests with them.\r\nWhen an api request comes in using any token from that user, check when the last time that we verified this user's group and access was. The \"lastCheck\" should be stored on the UserAttribute CR as a new field. The check should rely on k8s client cache. Should not go to k8s-api/etc every time.\r\nIf the last time we checked is longer ago than the interval, fire off an event* to cause the groups and access to be checked again out-of-band\r\nUse the groups and accessibility that is already available to complete the current request.\r\n* When I say \"fire off an event\", I mean that we should POST to some new endpoint responsible for doing these checks. Additionally, the client code should simply rely on the k8s token and userAttibute client cache and assume that the endpoint will make the necessary changes and those changes will ultimately be reflected in these caches. We need to do it this way for two reasons:\r\n\r\nThis needs to work in an HA setup where there are multiple rancher api servers\r\nWe are eventually going to expose our token authentication proxy as k8s authentication webhook and run it locally in each RKE user cluster and so if it detects that a user needs reverified, its only option will be to \"call home\" to the rancher API."},"comment":{"url":"https://api.github.com/repos/rancher/rancher/issues/comments/451312069","html_url":"https://github.com/rancher/rancher/issues/17067#issuecomment-451312069","issue_url":"https://api.github.com/repos/rancher/rancher/issues/17067","id":451312069,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MTMxMjA2OQ==","user":{"login":"sangeethah","id":4266958,"node_id":"MDQ6VXNlcjQyNjY5NTg=","avatar_url":"https://avatars0.githubusercontent.com/u/4266958?v=4","gravatar_id":"","url":"https://api.github.com/users/sangeethah","html_url":"https://github.com/sangeethah","followers_url":"https://api.github.com/users/sangeethah/followers","following_url":"https://api.github.com/users/sangeethah/following{/other_user}","gists_url":"https://api.github.com/users/sangeethah/gists{/gist_id}","starred_url":"https://api.github.com/users/sangeethah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sangeethah/subscriptions","organizations_url":"https://api.github.com/users/sangeethah/orgs","repos_url":"https://api.github.com/users/sangeethah/repos","events_url":"https://api.github.com/users/sangeethah/events{/privacy}","received_events_url":"https://api.github.com/users/sangeethah/received_events","type":"User","site_admin":false},"created_at":"2019-01-03T23:33:47Z","updated_at":"2019-01-03T23:33:47Z","author_association":"MEMBER","body":"This feature works with master builds for Auth providers - openLdap , Azure AD, Github and FreeIPA auth providers.\r\n\r\nAble to see the group sync get triggered as expected for AuthUserInfoMaxAgeSeconds and AuthUserInfoResyncCron  settings. \r\n\r\nThere is no API available currently to trigger the group sync on demand. \r\n\r\n@maxkorp Reopening this issue to have an API made available for triggering group sync on demand."}}
{"actor":{"display_login":"sangeethah"}}