help request: openid-connect different clients unexpectedly shared the same auth session about apisix HOT 6 OPEN

Instead i am simply also already logged in against B with the user from A.

Can you describe this behaviour more in details? Is it like:

• visit /web/app1 and got a GUI auth page
• authenticate with user A
• visit /web/app2 and it does not ask for credentials while it should? (unexpected)

from apisix.

Yes of course, sorry if i was not precise enough.
So what i want is

• visit `/web/app1` and get KC GUI loginpage
  

• authenticate with user A
  

• visit `/web/app2` and get KC GUI loginpage
  

• authenticate with user B
  

instead it is like you described, user A is also logged in app2 , instead of beeing asked for credentials for app2.
Basically what i am asking for is an option to configure which routes belong to a session. So for example that i could say routes
/web/app1
and /api/* with host app1.mydomain.de get session_id A, and
/web/app2
and api* with host app2.mydomain.de get session_id B, so that if a user with session_id A comes to web/app2, he is not treated as authenticated.
Maybe thats already somewaht there and its a bug on my side, but so far i couldnt figure anything out that would trigger that behaviour. Already checked a bit of the code to to figure out if can make some plugin for myself here, but my lua-knowledge tends towards zero :\

from apisix.

That is so very strange... Especially if you said using different session secrets also doesn't work as intended. I understand your issue now but I'm working on other things at the moment. I can surely circle back when I have time.

from apisix.

That would be really great.
The only way i could achieve that target is by having my kc-clients in different realms, wich is actually okay for the moment, but it would be really nice to be able to configure that a bit more independently from that.
I can provide you my full configuration if you want, its just a bit longer and the example i provided mirrors pretty well what i have there :)

from apisix.

cc @shreemaan-abhishek

from apisix.

I encountered the same issue, and I had made a pull request #11286 to solve this problem. Test passed

from apisix.