Generic oAuth + session time out

Grafana
1

I have started a grafana container as below.
I have enabled generic oauth.

Also, there is a reverse proxy in between where /login is redirected to /login/generic_oauth and /logout is redirected to keycloak logout.

Auto refresh is disabled on all dashboards.

Now, irrespective of the reverse proxy, I think that after 10 secs the user should be logged out, which is not happening. Am I missing any configuration?

docker run -d \
-p 3001:3000 \
--name=grafana-goauth2 \
-e "GF_LOG_MODE=console file" \
-e "GF_INSTALL_PLUGINS=savantly-heatmap-panel,mtanda-histogram-panel,grafana-piechart-panel,vonage-status-panel,raintank-snap-app" \
-e "GF_AUTH_GENERIC_OAUTH_ENABLED=true" \
-e "GF_AUTH_GENERIC_OAUTH_CLIENT_ID=goauth" \
-e "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=abc" \
-e "GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://kc-url:31443/auth/realms/realm/protocol/openid-connect/auth" \
-e "GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://kc-url:31443/auth/realms/realm/protocol/openid-connect/token" \
-e "GF_AUTH_GENERIC_OAUTH_API_URL=https://kc-url:31443/auth/realms/realm/protocol/openid-connect/userinfo" \
-e "GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true" \
-e "GF_AUTH_GENERIC_OAUTH_TLS_CLIENT_CERT=/etc/grafana/cert.crt" \
-e "GF_AUTH_GENERIC_OAUTH_TLS_CLIENT_KEY=/etc/grafana/key.key" \
-e "GF_AUTH_GENERIC_OAUTH_TLS_CLIENT_CA=/etc/grafana/ca.crt" \
-e "GF_AUTH_SIGNOUT_REDIRECT_URL=http://grafana-url:8081" \
-e "GF_SERVER_ROOT_URL=http://grafana-urll:8081" \
-e "GF_USERS_ALLOW_SIGN_UP=false" \
-e "GF_AUTH_DISABLE_LOGIN_FORM=false" \
-e "GF_SESSION_SESSION_LIFE_TIME=10" \
-e "GF_SECURITY_LOGIN_REMEMBER_DAYS=0" \
-v /root/plays/files:/etc/grafana \
grafana/grafana:5.2.1
2

What kind of action do you expect from “logout”?
GF_SESSION_SESSION_LIFE_TIME=10 => cookie will expire after 10 seconds. Don’t expect any automatic UI log out - Configure Grafana | Grafana documentation

Browser console (network requests/cookies) is the best tool to understand auth behaviour.

3

Is there a way to do a auto logout after 10 secs?

I have embedded grafana in my angular app, I call the grafana /logout url from that app. Now at the backend the user is logged out but if grafana is open in a separate tab independently the user still remains logged in. If I do a refresh of grafana (which was opened in a different tab) it redirects me to the login page

So I want some mechanism where I can keep the session duration short and force grafana to check if user is still logged in.