Where is the session data stored?

[dushyantbangal]

Does the plugin manage sessions by itself? If yes, where is the session related data stored?

Initially I thought it might be using the php session management itself. But there are no files in /tmp directory after I login in my application. However I see files in the /tmp directory when I just added a php file which does session_start() and accessed that file's URL via my browser.

Are there any settings that I should be looking at for this?

[dushyantbangal]

The issue I am facing is that the user gets logged out when my kubernetes pod restarts or gets killed.

This happens even when I still have the wordpress_sec cookie in my browser, and the wp_usermeta still have the token in it. This makes me think something is being written in the pod itself.

[timnolte]

@dushyantbangal sorry for the delay in responding to you question. I've converted this to a Q&A Discussion topic.

To answer your question the plugin doesn't establish its own session but establishes a standard WordPress session. The only additional aspect however is that there are some states stored in the database, and there is a refresh token item that can cause a WordPress session to be logged out if the IDP puts a limit on the length of a logged in session.

[dushyantbangal]

@timnolte thanks for the reply.
You're saying it establishes a standard Wordpress session, and from what I see in wordpress docs, they establish a standard php session.

However, I dont see anything in the php session (file system based) directory. When I call the php create session function in a simple php file, I do get the php session. That led me to believe this plugin is handling it in some other way.

[timnolte]

FYI, the process for logging in a WP user, after IDP authentication, is here:

openid-connect-generic/includes/openid-connect-generic-client-wrapper.php

Lines 665 to 684 in 99ec7c8

	public function login_user( $user, $token_response, $id_token_claim, $user_claim, $subject_identity ) {
	// Store the tokens for future reference.
	update_user_meta( $user->ID, 'openid-connect-generic-last-token-response', $token_response );
	update_user_meta( $user->ID, 'openid-connect-generic-last-id-token-claim', $id_token_claim );
	update_user_meta( $user->ID, 'openid-connect-generic-last-user-claim', $user_claim );
	// Allow plugins / themes to take action using current claims on existing user (e.g. update role).
	do_action( 'openid-connect-generic-update-user-using-current-claim', $user, $user_claim );
	// Create the WP session, so we know its token.
	$expiration = time() + apply_filters( 'auth_cookie_expiration', 2 * DAY_IN_SECONDS, $user->ID, false );
	$manager = WP_Session_Tokens::get_instance( $user->ID );
	$token = $manager->create( $expiration );
	// Save the refresh token in the session.
	$this->save_refresh_token( $manager, $token, $token_response );
	// you did great, have a cookie!
	wp_set_auth_cookie( $user->ID, false, '', $token );
	do_action( 'wp_login', $user->user_login, $user );
	}