Managing user-owned OAuth access tokens

Users can review their own OAuth access tokens and delete any that are no longer needed.

Listing user-owned OAuth access tokens

You can list your user-owned OAuth access tokens. Token names are not sensitive and cannot be used to log in.

Procedure

  • List all user-owned OAuth access tokens:

    1. $ oc get useroauthaccesstokens

    Example output

    1. NAME       CLIENT NAME                    CREATED                EXPIRES                         REDIRECT URI                                                       SCOPES
    2. <token1>   openshift-challenging-client   2021-01-11T19:25:35Z   2021-01-12 19:25:35 +0000 UTC   https://oauth-openshift.apps.example.com/oauth/token/implicit      user:full
    3. <token2>   openshift-browser-client       2021-01-11T19:27:06Z   2021-01-12 19:27:06 +0000 UTC   https://oauth-openshift.apps.example.com/oauth/token/display       user:full
    4. <token3>   console                        2021-01-11T19:26:29Z   2021-01-12 19:26:29 +0000 UTC   https://console-openshift-console.apps.example.com/auth/callback   user:full

  • List user-owned OAuth access tokens for a particular OAuth client:

    1. $ oc get useroauthaccesstokens --field-selector=clientName="console"

    Example output

    1. NAME       CLIENT NAME                    CREATED                EXPIRES                         REDIRECT URI                                                       SCOPES
    2. <token3>   console                        2021-01-11T19:26:29Z   2021-01-12 19:26:29 +0000 UTC   https://console-openshift-console.apps.example.com/auth/callback   user:full

Viewing the details of a user-owned OAuth access token

You can view the details of a user-owned OAuth access token.

Procedure

  • Describe the details of a user-owned OAuth access token:

    1. $ oc describe useroauthaccesstokens <token_name>

    Example output

    1. Name:                        <token_name> (1)
    2. Namespace:
    3. Labels:                      <none>
    4. Annotations:                 <none>
    5. API Version:                 oauth.openshift.io/v1
    6. Authorize Token:             sha256~Ksckkug-9Fg_RWn_AUysPoIg-_HqmFI9zUL_CgD8wr8
    7. Client Name:                 openshift-browser-client (2)
    8. Expires In:                  86400 (3)
    9. Inactivity Timeout Seconds:  317 (4)
    10. Kind:                        UserOAuthAccessToken
    11. Metadata:
    12.   Creation Timestamp:  2021-01-11T19:27:06Z
    13.   Managed Fields:
    14.     API Version:  oauth.openshift.io/v1
    15.     Fields Type:  FieldsV1
    16.     fieldsV1:
    17.       f:authorizeToken:
    18.       f:clientName:
    19.       f:expiresIn:
    20.       f:redirectURI:
    21.       f:scopes:
    22.       f:userName:
    23.       f:userUID:
    24.     Manager:         oauth-server
    25.     Operation:       Update
    26.     Time:            2021-01-11T19:27:06Z
    27.   Resource Version:  30535
    28.   Self Link:         /apis/oauth.openshift.io/v1/useroauthaccesstokens/<token_name>
    29.   UID:               f9d00b67-ab65-489b-8080-e427fa3c6181
    30. Redirect URI:        https://oauth-openshift.apps.example.com/oauth/token/display
    31. Scopes:
    32.   user:full (5)
    33. User Name:  <user_name> (6)
    34. User UID:   82356ab0-95f9-4fb3-9bc0-10f1d6a6a345
    35. Events:     <none>
    1The token name, which is the sha256 hash of the token. Token names are not sensitive and cannot be used to log in.
    2The client name, which describes where the token originated from.
    3The value in seconds from the creation time before this token expires.
    4If there is a token inactivity timeout set for the OAuth server, this is the value in seconds from the creation time before this token can no longer be used.
    5The scopes for this token.
    6The user name associated with this token.

Deleting user-owned OAuth access tokens

The oc logout command only invalidates the OAuth token for the active session. You can use the following procedure to delete any user-owned OAuth tokens that are no longer needed.

Deleting an OAuth access token logs out the user from all sessions that use the token.

Procedure

  • Delete the user-owned OAuth access token:

    1. $ oc delete useroauthaccesstokens <token_name>

    Example output

    1. useroauthaccesstoken.oauth.openshift.io "<token_name>" deleted