Skip to content

CA-414418: Sessions do not got destroyed after domain user been removed and performance improvement #6609

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 2, 2025
Merged

CA-414418: Sessions do not got destroyed after domain user been removed and performance improvement #6609

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b0e2b5b
CA-414418: Detection of AD account removal does not cause logout
liulinC Jul 31, 2025
92377bf
CA-414418: Perf: save user validate result and apply to sessions
liulinC Jul 31, 2025
2778096
CA-414418: Code refine for comments
liulinC Aug 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 1 addition & 9 deletions ocaml/xapi/xapi_session.ml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,15 +472,7 @@ let revalidate_external_session ~__context ~session =

(* CP-827: if the user was suspended (disabled,expired,locked-out), then we must destroy the session *)
let suspended, _ =
is_subject_suspended ~__context ~cache:true authenticated_user_sid
in
let suspended =
if suspended then
is_subject_suspended ~__context ~cache:false
authenticated_user_sid
|> fst
else
suspended
is_subject_suspended ~__context ~cache:false authenticated_user_sid
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure this solves the original bug?
AFAICT the initial query with 'cache:true' found that the account is missing (suspended), and the 2nd query with 'cache:false' said that it is not suspended (so I was guessing that winbind might also be caching something), but I may have misinterpreted the logs.

Copy link
Collaborator Author

@liulinC liulinC Jul 31, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, the initial query with cache:true will always succeed and found the account not suspended.
(As xapi db update thread never update it due to NOT_FOUND exception)
The update db thread can not handle it, refer to my comments in the CA ticket.
And I verified it can resolve the issue.

in
if suspended then (
debug
Expand Down