Forum Discussion

marvide's avatar
marvide
Adept
4 years ago

Logging a user out not working

Hello,

I'm currently developing a solution to log out a user from the community sessions automatically. I followed the API Reference here: https://developer.khoros.com/khoroscommunitydevdocs/reference/authsignout

I am currently getting the correct response of the user being signed out of all sessions but when I go to the community forums with my test user I can still see the user logged in.

This is the json response that I am receiving:

{
  "status":"success",
  "message":"",
  "data":
  {
    "signed_off_all_sessions":true,
    "id":"#######"
  }
}

Context: we do use a cookie for our users to log into the community site if they are logged into our site. But I have made sure to just be logged into the community site without said cookie when trying this call out. 

 

Any help would be welcomed.

API
Rest API
REST API v2 & LiQL
  • Claudius's avatar
    Claudius
    Boss
    4 years ago

    Are you using the correct body parameter for your setup? E.g. sso_id if your setup is using SSO or just id when you are using Khoros community authentication. Not sure if mixing them up would actually work, but I've personally already mixed up ids versus SSO ids before 😛

    • marvide's avatar
      marvide
      Adept
      4 years ago

      I was indeed sending both the id and the sso_id at the same time. Right now I tried just sending the sso_id like this:

       

      {
  sso_id: $user_sso_id
}

       

      And it's still returning the correct response of all sessions being logged out, but I am still clearly not logged out. 😞

       

      Edit: Just tried sending the user id like so

      {
  id : $user_id
}

      And still, the user is not logged out.

  • marvide's avatar
    marvide
    Adept
    3 years ago

    I still have not found what the issue seems to be.

    My staging user and production user have the same grants, and I checked that both have `Manage roles, user bans, and abuse notifications in admin and user profiles` permission as granted.

    The staging user does sign out other users when making the call to the staging api while the prod user does not.

     

    I would love some more insight into this one, because I think I've already exhausted all my options.

  • DougS's avatar
    DougS
    Khoros Oracle
    3 years ago

    Hi marvide 

    I seem to have missed this thread when I was mentioned before. Apologies for that. 

    Are you using OAuth 2.0 (passing Authorization and client-id headers) or a REST V1 Session Key (passing li-api-session-key header or restapi.session_key parameter) to authenticate to the API when you make the signout call? Also, are you making the signout call as the same user you are signing out, or a different user?

    It looks like if you authenticate via OAuth 2.0 it signs off your OAuth user (revokes your access token), but doesn't sign you out of any web sessions you have going.

     

    -Doug

    • marvide's avatar
      marvide
      Adept
      3 years ago

      I am using a REST V1 Session Key to authenticate to the API.

      About the user making these API calls, we have a production and staging environment.

      • In production we have the user APIUser, which has an admin role that has allow grant for all permissions.
      • In staging we have the user api_only, which also has an admin role with allow grant for all permission.

      In production, we receive confirmation that the user we are trying to sign out has been signed off all sessions, but when I go and check the community, the web session is kept alive.

      In staging, we also receive confirmation that the user has been signed off all sessions and the web session is also killed.

      I'm not sure why the behavior is like this, but it is consistent.

      • DougS's avatar
        DougS
        Khoros Oracle
        3 years ago

        Hi marvide 

        This seems like a bug with the signoff logic that runs when you make the call (it also seems like a bug that it doesn't sign off web sessions when you use OAuth).

        Would you mind opening a support case for this? That will get a bug opened in our system which we can track and get resolved for you. Please reference this thread in the case when you open one.

        Thanks,

        -Doug