kubeflow / manifests

A repository for Kustomize manifests
Apache License 2.0
772 stars 836 forks source link

OIDC authentication with SSO kubeflow page getting session timed out #2767

Open subasathees opened 3 days ago

subasathees commented 3 days ago

Validation Checklist

Version

1.8

Describe your issue

Hi All, Facing kubeflow page session expire when it's in ideal for more then 15 min. we want to keep the ideal session more then 1 hour mininum.

Note: Uses are running notebooks for modal testing which taken more then 1 hour and kubeflow page session should not expire.

Environment Details: Kubeflow Version: v1.8 Kubernetes version: v 1.23.5 Kubeflow setup: followed the kubeflow manifest method. We are running pingid for sso auth.

OIDC POD Error: After 15 min of ideal session.

time="2024-06-18T15:54:42Z" level=error msg="
Failed to refresh token: oidc: get access token: oauth2: cannot fetch token: 400 Bad Request
\nResponse: {\"error_description\":\"unknown, invalid, or **expired refresh token**\",\"error\":\"invalid_grant\"}" context="session authenticator" ip=10.233.109.143 request="/notebook/tai-titer-da-ws/firsttest/api/kernels?1718726082426"
time="2024-06-18T15:54:42Z" level=info msg="**OAuth2 tokens have expired, revoking OIDC session**" context="session authenticator" ip=10.233.109.143 request="/notebook/tai-titer-da-ws/firsttest/api/kernels?1718726082426"
time="2024-06-18T15:54:42Z" level=info msg="Attempting to revoke refresh token..."
time="2024-06-18T15:54:42Z" level=error msg="Failed to refresh token: oidc: get access token: oauth2: cannot fetch token: 400 Bad Request\nResponse: {\"error_description\":\"unknown, invalid, or expired refresh token\",\"error\":\"invalid_grant\"}" context="session authenticator" ip=10.233.109.143 request="/notebook/tai-titer-da-ws/firsttest/api/terminals?1718726082425"
time="2024-06-18T15:54:42Z" level=info msg="OAuth2 tokens have expired, revoking OIDC session" context="session authenticator" ip=10.233.109.143 request="/notebook/tai-titer-da-ws/firsttest/api/terminals?1718726082425"
time="2024-06-18T15:54:42Z" level=info msg="Attempting to revoke refresh token..."

OIDC Provider configuration. File: common/oidc-client/oidc-authservice/base/params.env

OIDC_PROVIDER=https://auth.example.com
OIDC_AUTH_URL=https://auth.example.com/as/authorization.oauth2
OIDC_SCOPES=profile email
REDIRECT_URL=https://kfserver.example.com/login/oidc
AUTHSERVICE_URL_PREFIX=/authservice/
USERID_HEADER=kubeflow-userid
USERID_PREFIX=
USERID_CLAIM=email
GROUPS_CLAIM=
GROUPS_HEADER=
PORT="8080"
STORE_PATH=/var/lib/authservice/data.db
LOG_LEVEL=INFO
SKIP_AUTH_URLS=/as
AFTER_LOGOUT_URL=https://auth.example.com/idp/startSLO.ping
CACHE_ENABLED=true
CACHE_EXPIRATION_MINUTES=1440

Error From Kubeflow page: image

Steps to reproduce the issue

  1. Install and configure kubeflow v1.8 as per document
  2. Configure Any OIDC SSO for UI authentication
  3. run a jupyter notebook and wait for 15 min ideal, the session timeout start.

Put here any screenshots or videos (optional)

No response