You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When the keystore conatins expired or invalid access- and refresh-tokens and an active instance with authMethod: oidc is linked, during app start a new authorization request is made.
If the user then logs in with a different user than linked in the active instance, unarchiving of the Balloon Dir fails.
To Reproduce
1.) Login with oidc user a
2.) Logout and login with oidc user b
3.) Stop Balloon
4.) change accessToken and refreshToken in keystore to invalid values.
5.) Start app again
6.) Login with user a
Expected behavior
1.) ~/Balloon should be archived to ~/Balloon-b,
2.) ~/Balloon-a should be unarchived to ~/Balloon
3.) User a should be logged in
Probably also auth.login() should only call refreshAccessToken and also _refreshOidcAccessToken should only call oidcCtrl.refreshAccessToken and if it fails not create a new authorization request. For now auth.login() calls oidcAuth which calls oidcCtrl.signin, which tries first to refresh the access token, and if that fails creates a new authorization request.
logger.info('oidc login failed, open startup configuration',{
category: 'auth',
error: err
});
startup().then(resolve).catch(reject);
Environment
desktop client version: v1.3.x (39f0000) and before.
client os: OSX
Additional context
As long as the user does not log in with user b or via another identity provider, the error persists.
Although in the case, that the user logs in via basic auth or another identity provider
a.) the Data Dir of user B is wrongly archived to ~/Balloon-a-1 and the instance of user B is not correctly updated.
b.) the synchronization stops with E_BLN_CONFIG_CREDENTIALS and the accounts gets unlinked.
c.) the config in the instance of user A gets messed up with information of user B (eg.: balloonDir, path to instance dir)
Describe the bug
When the keystore conatins expired or invalid access- and refresh-tokens and an active instance with authMethod:
oidc
is linked, during app start a new authorization request is made.If the user then logs in with a different user than linked in the active instance, unarchiving of the Balloon Dir fails.
To Reproduce
1.) Login with oidc user a
2.) Logout and login with oidc user b
3.) Stop Balloon
4.) change accessToken and refreshToken in keystore to invalid values.
5.) Start app again
6.) Login with user a
Expected behavior
1.) ~/Balloon should be archived to ~/Balloon-b,
2.) ~/Balloon-a should be unarchived to ~/Balloon
3.) User a should be logged in
Probably also auth.login() should only call
refreshAccessToken
and also_refreshOidcAccessToken
should only calloidcCtrl.refreshAccessToken
and if it fails not create a new authorization request. For now auth.login() callsoidcAuth
which callsoidcCtrl.signin
, which tries first to refresh the access token, and if that fails creates a new authorization request.balloon-client-desktop/app/lib/auth/controller.js
Lines 406 to 412 in 39f0000
Environment
Additional context
As long as the user does not log in with user b or via another identity provider, the error persists.
Although in the case, that the user logs in via basic auth or another identity provider
a.) the Data Dir of user B is wrongly archived to ~/Balloon-a-1 and the instance of user B is not correctly updated.
b.) the synchronization stops with
E_BLN_CONFIG_CREDENTIALS
and the accounts gets unlinked.c.) the config in the instance of user A gets messed up with information of user B (eg.: balloonDir, path to instance dir)
Also see: #161
The text was updated successfully, but these errors were encountered: