Pangolin consults the IdP only at login and keeps its own session
afterwards, so disabling a user or revoking their sessions in the IdP
does not end their Pangolin sessions.
Store the IdP refresh token at OIDC login as a grant and redeem it at
most every server.idp_session_revalidation_minutes (default 5). If the
IdP rejects it with invalid_grant, the grant is marked revoked and all
sessions backed by it and their resource sessions are deleted. Other
errors (IdP unreachable or slower than 10 seconds, invalid_client after
a secret change) keep the sessions valid and are retried after at most
a minute instead of on every request.
Only the instance holding a lease on the grant in the primary database
redeems its refresh token, and it writes the result only while it still
holds the lease, so instances never redeem the same token concurrently.
The per-request lookup reads from a replica through safeRead.
Device logins of the Pangolin clients share the grant of the browser
session that approved them, read from the primary database, so a rotated
refresh token is never redeemed twice by separate sessions.
The Entra ID provider type hardcodes its scopes, so it now requests
offline_access to get a refresh token.
Status rows written in the same second have equal timestamps, and the
batched query returns them in an order that depends on which other
resources are in the request. When a recovery event sorted before the
failure it followed, the resource stayed unhealthy until its next event.
Break timestamp ties by id in the queries and in computeBuckets.
Fixes#3994
Owen
miloschwartz
Severin Enzler
Owen SchwartzandGitHub
ASPCODESandOwen
Jan PilařandOwen
RishavTiwari25