Redirect to login screen immediately when SSO cookie token is no longer found

XMLWordPrintable

    • Type: Suggestion
    • Resolution: Unresolved
    • None
    • Component/s: None
    • 2
    • 26

      NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.

      When Confluence is set up to use SSO via Crowd, the following message will show up the logs numerous times when Confluence can't find the token key generated by Crowd for SSO:

      2014-08-20 09:35:44,601 ERROR [http-8090-32] [integration.seraph.v25.CrowdAuthenticator] getUser Could not find cookieToken from authenticated request
      

      This happens when a user is logged in to more than one app (like JIRA and Confluence) via SSO, and then logs out of one of the applications but keeps the other one open in another browser window or tab and doesn't refresh or click around. Confluence is still running for that user and firing off periodic service calls (e.g., to get the count of unseen notifications), but cannot find the Crowd token key anymore since it was deleted when the user logged out of the other SSO-linked application.

      If a user then clicks on anything within Confluence, the action will generate a large number of authentication errors before kicking the user back to the log in screen.

      Instead of waiting for the user to initiate a click to redirect to the login screen, perhaps we can improve this and reduce the amount of log entries by automatically redirecting to the login screen once Confluence determines that the required Crowd token key is no longer present.

            Assignee:
            Unassigned
            Reporter:
            Brian
            Votes:
            16 Vote for this issue
            Watchers:
            13 Start watching this issue

              Created:
              Updated: