We have an A12 Client Application based on the A12 Project Template that uses SAML for authentication with UAA.
For testing we shortened the token expiration time by configuring these server properties:
mgmtp.a12.uaa.authentication.jwt.expiration-seconds=60
mgmtp.a12.uaa.authentication.jwt.user-lifetime-seconds=30
I noticed that when the token expires the client tries to authenticate again by sending 4 requests to /api/uaa-authentication/authorize each returning status 401. In this case no automatic logout in the client happens leading to the behavior that the client is not usable anymore (endpoints all return 401 and even manual user logout is not possible). The client remains in state “authenticated” in this case.
Does UAA offer an automatic client logout for this scenario and how can I enable it?
If not, how can I implement this myself in a robust way?
Hi,
Requests to /authorize indicate that the token renewal process is underway. The process is triggered before the token is about to expire but must not be expired yet. You configured expiration-seconds greater than user-lifetime-seconds (60>30) and that’s why the requests are failed with 401 unauthenticated. Uaa based on expiration-seconds and token-renew-threshold-in-seconds (default 15s) to calculate the time trigger token renewal => 60 - 15 = 45 => the process is triggered at the second 45. However, in that moment the token is already expired due to the user-lifetime-seconds is only 30. To correct it, in most of the time, the user-lifetime-seconds must be greater than expiration-seconds + token-renew-threshold-in-seconds for the guarantee of renewal process.
Why exactly 4 failed requests? In Uaa-client, it has MAX_RETRY_TIME = 3 and RETRY_INTERVAL_IN_SECOND = 5, the renewal runs once, gets 401, then retries on a 5-second timer. It stops when retryTime === MAX_RETRY_TIME. That’s 1 initial attempt + 3 retries = 4
requests to /authorize, all returning 401, spaced ~5s apart.
After all retries, Uaa dispatches the signal through action UaaActions.silentRenewError() that project can observe it and does its own logging out like UaaClient.getLocalClient()/getSamlClient().logout(), Uaa does not automate it.
Hope this would help you.