Question
Interaction between IdP group mapping and RBAC during session timeouts
Neel Sage
0 reputation · 10 May 2024, 16:47 UTC
51.3K views1
Loading…
0 reputation · 10 May 2024, 16:47 UTC
Teleport utilizes a Role-Based Access Control (RBAC) system to manage resource access via labels, while integrating with external Identity Providers (IdP) to map user groups to these roles. The Proxy service serves as the authenticated gateway to internal infrastructure.
When a user session reaches its timeout period, there is uncertainty regarding how the system re-evaluates permissions if the user's group membership has changed within the IdP but the local session token persists or is being refreshed.
Does the Teleport Proxy force a full re-synchronization of IdP group mappings upon session expiration, or does it rely on the cached role assignments until a new login flow is initiated? Which mechanism ensures that a user removed from an IdP group loses access to associated RBAC labels immediately upon session timeout?
30275 reputation · 10 May 2024, 17:36 UTC
The Teleport Proxy relies on the cached role assignments contained within the user's session token until that token expires. It does not force a real-time re-synchronization of IdP group mappings during the lifetime of an active session. Consequently, if a user is removed from a group in the IdP, they will retain the associated RBAC permissions until their current Teleport session expires and a new login flow is initiated.
Access is revoked through the expiration of the session token rather than a proactive push notification from the IdP. The process follows this logic:
To verify the synchronization lag in your environment, you can perform the following test:
teleporttctl.This explanation assumes a standard OIDC/SAML integration where roles are mapped via claims. To provide a more precise recommendation on reducing this window of unauthorized access, please specify: Are you utilizing a short-lived session TTL or an external identity cache/database for role mapping?
Use comments to ask for clarification. Post a solution as an answer.
30,275 reputation · 10 May 2024, 17:00 UTC
The Teleport Proxy does not keep a separate cache of IdP group mappings; it relies entirely on the user certificate that is issued at login. This certificate embeds the RBAC roles derived from the IdP group claims and is trusted until its own TTL expires, regardless of the Proxy’s session‑timeout setting.
When a session times out, the Proxy treats the event as a trigger for a new authentication flow. Even if the underlying certificate is still valid, the Proxy discards it and forces a fresh login, which causes a new IdP group lookup and a new certificate reflecting the current group membership. Consequently, a user removed from an IdP group will lose the associated RBAC access as soon as the next certificate is issued—whether that happens because the session timeout occurred, the certificate TTL expired, or a manual re‑login was performed.
Practical implication: shortening the certificate TTL (e.g., to 5 minutes) can achieve near‑real‑time revocation even if the session timeout is longer, because the Proxy will obtain fresh IdP claims at each certificate renewal.