DongHyeonkaandClaude Opus 5
e856e7af4d
One user session carries a client session per application, so visiting the second app skips the login screen. Deleting the identity provider session leaves both application sessions untouched and both apps keep serving, because the identity provider, the application session and the access token each have their own lifetime. That inverts the B-2 finding: there the app session was cleared and the surviving SSO session let the user straight back in. Either way, clearing one side leaves the other. It also means an identity provider outage is a single point of failure for logging in, not for already-authenticated users, and the failure arrives late and all at once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
26 lines
1019 B
Plaintext
26 lines
1019 B
Plaintext
=== ★ Keycloak 의 SSO 세션 하나를 죽인다 ===
|
|
남은 Keycloak 세션: 1
|
|
|
|
=== 두 앱의 애플리케이션 세션은 그대로인가 ===
|
|
_oauth2_proxy-6b028a70f69c8f0da9966eb36972dff2
|
|
bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
|
|
PostgreSQL authorized client: 1 행
|
|
|
|
→ IdP 세션은 없어졌는데 앱 세션은 남아 있다면, 두 계층의 수명이 어긋난 것이다
|
|
=== 사용자 단위 로그아웃 (IdP 세션만 끊는다) ===
|
|
남은 Keycloak 세션: 1
|
|
|
|
=== 앱 세션은 남아 있는가 ===
|
|
_oauth2_proxy-6b028a70f69c8f0da9966eb36972dff2
|
|
bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
|
|
PostgreSQL authorized client: 1 행
|
|
=== 남은 세션의 realm 과 client ===
|
|
user_session_id | realm | clients
|
|
--------------------------+--------+---------
|
|
E1q5xI7tt4U_WhZpW7rEPIF2 | master | 1
|
|
(1 row)
|
|
|
|
|
|
=== 브라우저에서 두 앱을 다시 열면 어떻게 되는가 ===
|
|
(IdP 세션이 사라졌으면 재로그인이 필요해야 한다)
|