Add support for invalidating users JWTs #17465

shweta83 · 2025-01-30T11:18:24Z

Problem Statement

Add support for Invalidate JWT feature : SAT-27385

Solution

Added support for it.

Related Issues

SatelliteQE/airgun#1721

tests/foreman/ui/test_user.py

lhellebr · 2025-01-31T14:55:27Z

tests/foreman/ui/test_user.py

@@ -307,6 +308,88 @@ def test_positive_create_product_with_limited_user_permission(
        assert newsession.product.search(product_name)[0]['Name'] == product_name


+@pytest.mark.rhel_ver_match('8')


Missing tier decorator

Do we really need tier decorator now? What is the purpose to use it. I thought it has become obsolete now.

Frankly, I don't know. At least for consistency, I would expect it to be there. Best to ask CI team what is expected regarding tier decorators.

I remember a discussion over it and I think it is not required but would like to have some thoughts on it.
@devendra104 wdyt?

lhellebr · 2025-01-31T14:57:17Z

tests/foreman/ui/test_user.py

+    :id: be328fd7-b640-4080-9373-25f96ba2aef6
+
+    :steps:
+            1. Create an admin user and an non-admin user with "edit_users" and "view_users" permissions.


Should there also be a test for a user without edit_users and view_users permissions invalidating their own JWT token?

It doesn't work with UI as Administer -> Settings -> User tab won't be visible without these permissions so I left that out.

From the ticket, Scope part:

A user can invalidate self's token

Yeah, that too needs same permissions for UI.

lhellebr · 2025-01-31T15:02:04Z

tests/foreman/ui/test_user.py

+        'password': password,
+    }
+    role = module_target_sat.cli.Role.info({'name': 'Register hosts'})
+    module_target_sat.cli.User.add_role({'id': non_admin_user.id, 'role-id': role['id']})


Can you add the role while creating the user?

This was intentionally done . There are 2 roles in it.

lhellebr · 2025-01-31T15:06:49Z

tests/foreman/ui/test_user.py

+        result = session.login.logout()
+
+        session.login.login(login_details)
+        session.user.invalidate_jwt(admin_user.login)


You don't assert anything after invalidating admin's token.

Yes, I missed that. Updated.

lhellebr · 2025-01-31T15:11:16Z

tests/foreman/ui/test_user.py

+            activation_keys=[ak.name],
+            force=True,
+        )
+        assert result.status == 1, f'Failed to register host: {result.stderr}'


There is probably a wrong error message when this fails. Also, it may be worth it checking more than just status.

Agree. Updated

lhellebr · 2025-01-31T15:14:06Z

tests/foreman/ui/test_user.py

+        session.organization.select(org.name)
+        session.location.select(module_location.name)
+        user_cfg = user_nailgun_config(non_admin_user, password)
+        result = rhel_contenthost.api_register(


I may be missing something here. Where do you generate the JWT? Does api_register do it? How come it doesn't do the same, i.e. generate a new JWT, when you use it the second time?

The token generated by registration command is the one. But, I have missed one point earlier which I have updated in the code. Please check.

shweta83 · 2025-02-04T07:46:18Z

trigger: test-robottelo
pytest: tests/foreman/ui/test_user.py -k test_positive_invalidate_jwt

Satellite-QE · 2025-02-04T08:04:26Z

PRT Result

Build Number: 10040
Build Status: UNSTABLE
PRT Comment: pytest tests/foreman/ui/test_user.py -k test_positive_invalidate_jwt --external-logging
Test Result : ========== 1 failed, 11 deselected, 21 warnings in 711.80s (0:11:51) ===========

shweta83 · 2025-02-04T08:33:43Z

trigger: test-robottelo
pytest: tests/foreman/ui/test_user.py -k test_positive_invalidate_jwt
airgun: 1721

Satellite-QE · 2025-02-04T08:55:23Z

PRT Result

Build Number: 10041
Build Status: SUCCESS
PRT Comment: pytest tests/foreman/ui/test_user.py -k test_positive_invalidate_jwt --external-logging
Test Result : ========== 1 passed, 11 deselected, 22 warnings in 726.32s (0:12:06) ===========

shubhamsg199

Ack, one suggestion

tests/foreman/ui/test_user.py

shweta83 · 2025-02-06T08:00:56Z

trigger: test-robottelo
pytest: tests/foreman/ui/test_user.py -k test_positive_invalidate_jwt
airgun: 1721

Satellite-QE · 2025-02-06T08:45:29Z

PRT Result

Build Number: 10087
Build Status: SUCCESS
PRT Comment: pytest tests/foreman/ui/test_user.py -k test_positive_invalidate_jwt --external-logging
Test Result : ========== 1 passed, 11 deselected, 24 warnings in 2272.02s (0:37:52) ==========

shweta83 added No-CherryPick PR doesnt need CherryPick to previous branches Stream Introduced in or relating directly to Satellite Stream/Master labels Jan 30, 2025

shweta83 requested a review from a team January 30, 2025 11:18

shweta83 requested a review from a team as a code owner January 30, 2025 11:18

github-actions bot assigned shweta83 Jan 30, 2025

amolpati30 requested changes Jan 31, 2025

View reviewed changes

tests/foreman/ui/test_user.py Outdated Show resolved Hide resolved

tests/foreman/ui/test_user.py Outdated Show resolved Hide resolved

tests/foreman/ui/test_user.py Outdated Show resolved Hide resolved

tests/foreman/ui/test_user.py Show resolved Hide resolved

lhellebr reviewed Jan 31, 2025

View reviewed changes

shweta83 force-pushed the jwt_invalidate branch from a386f15 to 8fb7c35 Compare February 4, 2025 07:45

Satellite-QE added the PRT-Failed Indicates that latest PRT run is failed for the PR label Feb 4, 2025

shweta83 force-pushed the jwt_invalidate branch 3 times, most recently from 61314c6 to a71c6af Compare February 4, 2025 08:30

Satellite-QE added PRT-Passed Indicates that latest PRT run is passed for the PR and removed PRT-Failed Indicates that latest PRT run is failed for the PR labels Feb 4, 2025

shweta83 requested review from amolpati30 and lhellebr February 4, 2025 08:56

shweta83 mentioned this pull request Feb 4, 2025

Add support to invalidate users JSON Web Tokens SatelliteQE/airgun#1721

Merged

shweta83 requested a review from girijaasoni February 4, 2025 12:17

amolpati30 approved these changes Feb 4, 2025

View reviewed changes

shubhamsg199 approved these changes Feb 6, 2025

View reviewed changes

tests/foreman/ui/test_user.py Show resolved Hide resolved

Satellite-QE removed the PRT-Passed Indicates that latest PRT run is passed for the PR label Feb 6, 2025

Add support for invalidating users JWTs

795d840

shweta83 force-pushed the jwt_invalidate branch from 6784110 to 795d840 Compare February 6, 2025 07:51

Satellite-QE added the PRT-Passed Indicates that latest PRT run is passed for the PR label Feb 6, 2025

shubhamsg199 merged commit 2586247 into SatelliteQE:master Feb 6, 2025
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for invalidating users JWTs #17465

Add support for invalidating users JWTs #17465

shweta83 commented Jan 30, 2025

lhellebr Jan 31, 2025

shweta83 Feb 4, 2025

lhellebr Feb 4, 2025

shweta83 Feb 6, 2025

lhellebr Jan 31, 2025

shweta83 Feb 4, 2025

lhellebr Feb 4, 2025

shweta83 Feb 4, 2025

lhellebr Jan 31, 2025

shweta83 Feb 6, 2025

lhellebr Jan 31, 2025

shweta83 Feb 4, 2025

lhellebr Jan 31, 2025

shweta83 Feb 4, 2025

lhellebr Jan 31, 2025

shweta83 Feb 4, 2025

shweta83 commented Feb 4, 2025

Satellite-QE commented Feb 4, 2025

shweta83 commented Feb 4, 2025

Satellite-QE commented Feb 4, 2025

shubhamsg199 left a comment

shweta83 commented Feb 6, 2025

Satellite-QE commented Feb 6, 2025

		@@ -307,6 +308,88 @@ def test_positive_create_product_with_limited_user_permission(
		assert newsession.product.search(product_name)[0]['Name'] == product_name


		@pytest.mark.rhel_ver_match('8')

Add support for invalidating users JWTs #17465

Add support for invalidating users JWTs #17465

Conversation

shweta83 commented Jan 30, 2025

Problem Statement

Solution

Related Issues

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shweta83 commented Feb 4, 2025

Satellite-QE commented Feb 4, 2025

shweta83 commented Feb 4, 2025

Satellite-QE commented Feb 4, 2025

shubhamsg199 left a comment

Choose a reason for hiding this comment

shweta83 commented Feb 6, 2025

Satellite-QE commented Feb 6, 2025