SSO Timeout Configuration

[KevinThompsonYCRX]

In the new SSO implementation, it looks like the ID token never has the 'Expiry' field set, and defaults to having a 1 hour timeout. It would be more convenient if this was extended, and most convenient if it could be configured in the workflow controller configmap.

The cookie containing this token has a 10 hour timeout. It seems like it would make the most sense for this timeout to match the token Expiry.
https://github.com/argoproj/argo/blob/d07a0e74888254fe78fa653e532c5f1963056598/server/auth/sso/sso.go#L185-L192

This is where I believe the token Expiry value would need to be set:
https://github.com/argoproj/argo/blob/d07a0e74888254fe78fa653e532c5f1963056598/server/auth/sso/sso.go#L153-L165

Related documentation:
https://godoc.org/golang.org/x/oauth2#Token

[alexec]

The 10 hour limit is intended to be a working day. Would you like to raise a PR?

[KevinThompsonYCRX]

I haven't worked with golang before but I'll give it a try

[boniek83]

I'm under impression that the default is a lot lower than 1h. It is like 1 minute at most. It is infuriating to work like this :D

[KevinThompsonYCRX]

After doing some more research, it looks like the id_token timeout is determined by the oauth2 provider. For Azure, this is fixed at 3599 seconds (https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).

It seems like implementing a token_refresh is a more appropriate way to address this issue for me. @boniek83 what oauth provider are you using?

[boniek83]

@boniek83 what oauth provider are you using?

On premises gitlab.

[KevinThompsonYCRX]

I wrote up some rough changes to try and refreshing tokens, but it's not possible since oidc won't refresh id_tokens. This newer PR switches to using access tokens, which can be refreshed to extend SSO logins further: #4035. If refreshes get added into that PR, then this issue can be closed.

[alexec]

The timeout is currently the expiry of the id_token. This varies by provider, but is typically around 5m. This is not what anyone wants. We need to do more work to make this easier.

[alexec]

Once #4095 is merged, it'll be easy to add timeout. Would anyone like to submit a PR?

[arghya88]

@alexec so setting a timeout using an environment variable would be a reasonable approach?

[alexec]

I think this might be a commonly used feature. Maybe sso.timeout config item?

[arghya88]

I think this might be a commonly used feature. Maybe sso.timeout config item?

You mean set it in the cm https://github.com/argoproj/argo/blob/c71116ddedafde0f2931fbd489b9b17b8bd81e65/docs/workflow-controller-configmap.yaml and use that in code. Is there any other sso config that we can set now via cm? Nevertheless I can give this a try

[alexec]

yes - all SSO config is in the cm