Log error if Okta and DB role claims unequal #8182
Conversation
emyl3
force-pushed
the
elisa/7598-add-logs
branch
from
c39c587 to
8cd863e
Compare
emyl3
force-pushed
the
elisa/7598-add-logs
branch
from
8cd863e to
f800b08
Compare
|
| @@ -60,6 +60,8 @@ public List<OrganizationRoleClaims> findAllOrganizationRoles() { | |||
| String username = currentAuth.getName(); | |||
| List<OrganizationRoleClaims> dbOrgRoleClaims = | |||
| _dbOrgRoleClaimsService.getOrganizationRoleClaims(username); | |||
| _dbOrgRoleClaimsService.checkOrgRoleClaimsEquality( | |||
There was a problem hiding this comment.
organizationRolesContext and have to fetch it again? 🤔
Based on digging around in Azure, it seems like on initial log in and page load fetchCurrentOrganizationRoles (which is the only method that calls findAllOrganizationRoles is called a bunch of times and then not again for 20-30 mins or so...
I'm asking because I'm wondering if we are doing the check too frequently if I set the check at this point. 🤔
There was a problem hiding this comment.
Don't know off the top of my head. And not sure if the better place to look would be spring docs or okta's 🤔
There was a problem hiding this comment.
does this line mean that the context is only valid for a single request? if so it seems like it would need to be refetched any time we are handling a new request that needs the current org roles
There was a problem hiding this comment.
fwiw since we are condensing the logs into a single alert per day (?) it doesn't seem that harmful if we are logging frequently. though it may be a little bit of a pain to parse through the log lines later I don't see a super simple alternative 🤷
There was a problem hiding this comment.
Thank you for digging into that @mehansen. Based on what you shared, I'm surprised I didn't see it log more frequently when testing. 🤷 After I merge, I'll keep on eye on prod and the logs...
| @@ -159,7 +159,7 @@ void getUser_withAdminUser_withOktaMigrationDisabled_success() { | |||
|
|
|||
| UserInfo userInfo = _service.getUser(apiUser.getInternalId()); | |||
|
|
|||
| verify(_dbOrgRoleClaimsService, times(0)).getOrganizationRoleClaims((ApiUser) any()); | |||
| verify(_dbOrgRoleClaimsService, times(1)).getOrganizationRoleClaims((ApiUser) any()); | |||
There was a problem hiding this comment.
BACKEND PULL REQUEST
Related Issue
Changes Proposed
getUsermethodgetUserByLoginEmailmethodorganizationRolesContextAdditional Information
oktaMigrationEnabledfor certain dev envs for testing #8180Testing
[email protected]ondev3:SR-DEV3-TENANT:AK-Bobans-org-5145a894-3be7-45ea-a5a1-79895df0352c:ALL_FACILITIES