FlyteAdmin (external IdP access token / ID token expiration check): FlyteAdmin does not enforce expiry on access and ID

Impact

FlyteAdmin does not enforce expiry on access and ID tokens issued by an external identity provider, so a token stays usable after the user's session should have ended. Offboarded users and stolen tokens keep working, letting someone launch and inspect workflows on the cluster long after their access was supposed to be revoked.

Who can reach it

Anyone holding an expired but otherwise valid token from the external IdP, including a token pulled from a browser, a CI log or a laptop after offboarding. Deployments using flyteadmin itself as the OAuth2 authorization server are unaffected.

What to do

Upgrade FlyteAdmin to 1.1.30 or later and restart it. Until the upgrade lands, rotate the signing keys repeatedly - each rotation invalidates all open sessions and forces re-authentication, which is the only way to expire the outstanding tokens.

References