Hi @ameet_shah ,
¿I hope you are doing well?
We are currently analyzing how to allow privileged administrators to manage active user sessions in OpenIAM.
The requirement is that administrators should be able to:
- List or identify active user sessions.
- Terminate active sessions for specific users in OpenIAM, either:
- one specific session, or
- all active sessions for a given user.
- Revoke the related OAuth/OIDC tokens if required.
- Audit the administrative action.
Could you please confirm whether OpenIAM provides any out-of-the-box functionality to cover this requirement, or part of it, from the Administrative Webconsole?
What we have found so far:
Regarding session and token visibility, we found that some information can be obtained from the database tables:
-AUTH_STATE
-OAUTH_TOKEN
We also noticed that some token information can be viewed from the UI under the user-related menus, and that token revocation appears to be available from the UI or through the existing token revocation endpoint. However, for session termination, Is deleting directly from data base a supported method i don´t thing so.
we would prefer to avoid unsupported operations such as directly deleting database records. We also understand that simply revoking tokens through the /revoke endpoint may not be equivalent to performing a full user logout, especially if OpenIAM maintains server-side sessions, SSO state, or application session information. In a previous discussion, you mentioned the existence of:
AuthenticationService.globalLogoutRequest(...)
Additional technical context:
As additional context, we inspected our deployed OpenIAM binaries and found that openiam-esb.jar contains the following class:
BOOT-INF/classes/org/openiam/esb/core/service/impl/AuthenticationServiceImpl.class
This class includes a globalLogoutRequest(…) method with the following signature:
void globalLogoutRequest(org.openiam.base.request.LogoutRequest request)
The LogoutRequest DTO is available in:
BOOT-INF/lib/openiam-common-intf-4.2.1.15.jar
as:
org.openiam.base.request.LogoutRequest
This DTO appears to contain the following fields:
userId
patternId
token
sessionId
With the corresponding accessors:
getUserId / setUserId
getPatternId / setPatternId
getToken / setToken
getSessionId / setSessionId
Inside AuthenticationServiceImpl.class, we also observed references to:
getUserId
getPatternId
getSessionId
newLogoutEvent
LOGOUT
LOGOUT_EXCEPTION
Error while logout
This suggests that globalLogoutRequest(…) may be the internal logout event mechanism used to invalidate a user session based on userId, sessionId and possibly patternId.
We have also seen public OpenIAM Javadoc references showing that AuthenticationServiceImpl exposes a method named:
void globalLogoutRequest(LogoutRequest request)
although the exact DTO package appears to differ from the one used in our deployed version. [download.openiam.com]
Questions:
- Is there any out-of-the-box option in the Admin UI to invoke this logout functionality?
- ¿Could you please clarify whether this service is intended to?
- invalidate the OpenIAM user session,
- trigger a global logout event,
- revoke OAuth/OIDC tokens,
- and create the corresponding audit events?
- Can this method be used to terminate:
-
one specific user session?
-
all active sessions for a given user?
3. If there is no out-of-the-box UI option, what is the recommended approach?
-
At this stage, the following possible approaches come to mind… is there anything similar to
-
Is there any supported REST API endpoint for this functionality?
-
creating a custom internal REST endpoint,
-
invoking the service from a Groovy script.
-
using a custom OpenIAM resource or URI,
-
or using another supported extension point.
-
Could a Groovy script be used in combination with a custom endpoint or OpenIAM resource to call this service?
Is there any official documentation, real example, code sample or recommended implementation pattern for this requirement?
Kind Regards.
Mlmoreno.