Session manager (session-manager)

About the service

ParameterDescription
System name chartshturval-auth
Componentsh-session-manager
Cluster AssignmentHTTP API for listing active user sessions and deleting a session with cascade clearing of OAuth tokens.
CriticalYes
Namespaceshturval-backend

session-manager is included in the Helm chart shturval-auth. Typically the component is placed next to the authn-server, and the backend API accesses it through SESSION_LIST_URL and SESSION_DELETE_URL.

Contents

  1. Review
  2. Architecture
  3. Installation/deployment
  4. Diagnostics
  5. Lifecycle
  6. Service parameters

1. Review

Purpose: Support administrative and user scenarios for revoking sessions after login. The service provides a separate HTTP application that is called by the backend and works synchronously with the Redis session store and associated token store.

Session creation during login remains on the authn-server.

Features

ContourPurpose
GET /sessionsDisplaying active user sessions.
DELETE /sessions/:sidDeleting the session and associated tokens.
Redis storeShared session/token data storage with authn-server.

Initiation scripts

EventInitiatorEffect
Listbackend APIJSON list of sessions.
Delete sidPlatform operator or automationThe session and associated token records are removed from Redis.
Start checkpod initUnavailable Redis blocks the readiness of the workload.

Limitations and implications

LimitConsequence
Port fixed :8082The port cannot be changed without a compatible change in delivery.
No /health and /readyzProbes must rely on TCP/exec or other approved mechanism.
Redis only, no memory modeRedis is required for correct operation.
CORS always AllowAllOriginsConsider the network surface of the API.

Place in the chain of command

Backend API routes active user login management requests to session-manager. authn-server creates sessions and uses common session/token storage interfaces for login-flow.

Key Features

CharacteristicsDescription
Binarsh-session-manager
Process port0.0.0.0:8082
Co-locationSidecar in the same Deployment as authn (helm/auth/templates/dep-authn.yaml)
Separate Servicesvc-session-manager

2. Architecture

ComponentRole
sh-session-managerGin application of limited routes.
Session Redis clientReading and deleting user sessions.
Token Redis clientCascade clearing of OAuth tokens when deleting SIDs.
Backend APIThe calling platform component.

3. Installation / deployment

The deployment is set by Helm chart shturval-auth. The main placement is a shared pod with auth processes and a separate Service for internal calls from the backend.

Redis parameters and integration URLs are set through platform managed values and ShturvalServicePatch (SSP).

4. Diagnostics 

kubectl get svc -n "${NAMESPACE}"
kubectl logs -n "${NAMESPACE}" "${POD}" -c sh-session-manager --tail=200
SymptomReasonAction
HTTP 503 or SID removal timeouttoken store unavailableRestore Redis sentinel or credentials.
List is empty, although UI authorizes usersThe session-manager URL in the backend is incorrectCheck SESSION_LIST_URL and SESSION_DELETE_URL.
Split-brain recordings with multiple podssentinel or master endpoint unavailableCheck Redis topology and credentials.

The lack of a standard health-route increases the monitoring requirements: use platform-approved checks for a specific installation.

5. Life cycle

EtapBehavior
ListThe service reads the store and generates a response to the platform.
DeleteThe service sequentially deletes the session, then the associated token record.
StartBlocking check of Redis connections is performed.

6. Service parameters

VariablePurpose
SESSION_STORE_ADDR, SESSION_STORE_PASSWDRedis session data parameters.
TOKEN_STORE_ADDR, TOKEN_STORE_PASSWDRedis parameters of associated token records.
STORE_MASTER, SENTINEL_PASSWDSentinel topology.
LOG_LEVELLogging level.

Backend links SESSION_*_URL are configured in chart shturval-backend and must point to Service session-manager from chart shturval-auth.

← Client cluster manager (shturval-cluster-manager)
Module for searching nodes with running hostport services (shturval-coreha) →