Sessions and Tokens

Signing in to Stroom creates a session, and Stroom issues tokens that are used to prove who a user is, both to Stroom itself and between the nodes of a cluster. This page describes how sessions and tokens are ended, both by users for themselves and by administrators.

Ending Your Own Sessions

Any user can end their own sessions other than the one they are currently using, by selecting

from the main menu.

This is useful after signing in from a machine that is no longer under their control. It applies across every browser and device, and across every node in the cluster.

Completing a password reset also ends all of that user’s sessions, including the one being used at the time. See Signing In.

The User Access Screen

A user holding the Manage Users or Administrator Application permission Application permission This is a permission that is not specific to a single document. It applies to all documents or is not related to documents in any way.Click to see more details... can see and end the access held by other users by selecting

from the main menu.

The screen lists users along with how many sessions and tokens each currently holds, and shows the sessions held for the selected user across every node in the cluster.

Two actions are available.

• End this user’s sessions and revoke their tokens does exactly that, across the whole cluster rather than just the node serving the request. It does not withdraw their access: the account is untouched and they can sign in again.

• Open this user opens the selected user, where they can be disabled. This is offered alongside revocation because the two are easily confused and do quite different things, as described below.

Revoking, Disabling, and the Difference between Them

Three actions are easy to confuse, and each does something different. To stop someone using Stroom completely and immediately, you need the last two together.

Ending sessions and revoking tokens does both of those things and no more. It deliberately leaves the account alone, so the password still works and the user can sign in again. Every token revoked this way is dead permanently, but their access as a whole is not withdrawn. It forces re-authentication rather than shutting anybody out, which makes it the right action when you want to be certain that whoever is currently signed in has to prove who they are again.

Disabling the Stroom User User Refers to a Stroom User that is linked to either an Account in Stroom’s internal Identity Provider or a user account in an external Identity Provider. A Stroom User is primarily concerned with authorisation (i.e. application/document permissions and group memberships) rather than authentication, though disabling one also refuses that person at authentication and ends any access they currently hold.Click to see more details... does everything the above does, and additionally refuses them at authentication, whether they are signing in interactively or presenting a token. This is the action to take when someone must be stopped, and is what the Open this user button on the User Access screen is for.

Disabling the account, which only applies when Stroom is its own Identity Provider (IDP) Identity Provider (IDP) An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details..., stops them authenticating at all. It does not disturb a session that is already running. See User Accounts.

Token Lifetimes

These are the defaults, and are configurable under stroom.security.identity.token..

Refresh tokens can be used only once, and each use issues a replacement. If a refresh token is presented a second time, which suggests it has been copied, Stroom withdraws that token and every token descended from it.