topic "pep show user query usr" - Time Left in Firewall and Security Management

"pep show user query usr" - Time Left

enrico_azzolin — Mon, 07 Oct 2024 11:53:24 GMT

Hello,

below the output of the command "pep show user query usr". I see that in many cases the "time left" is automatically renewed before expiring. But in some case the pep entry is not renewed even if the user is actually working and the pdp gateway has a valid entry for the same user.

What is the mechanism driving the refresh of the user pep "time left" ?

Thanks

--------------------

[Expert@xxxxxxxxxxxxx:0]# pep show user query usr xxxx
Command: root->show->user->query

PDP: <xxxxxxxxxxxxxx, 00000000>; UID: <c2411256>
==================================================
Client ID : <xxxxxxxxxxxxxx, 00000000>
Authentication Key : <Unavailable>
Brute force counter: 0
Username : xxxx
Log Username : xxxxxxxxxxxxxxxxxxxxxx

Machine name :
User groups : <Unavailable>
Machine groups : <Unavailable>
Compliance : <Unavailable>
Identity Role : xxxxxxxxxxxxxxxxxxxxx
Time to live : 43230
Cached time : 86400
TTL counter : 43170
Time left : 39782
Client type : Identity Collector
Last update time : Mon Oct 7 09:09:11 2024

Re: "pep show user query usr" - Time Left

PhoneBoy — Mon, 07 Oct 2024 12:43:26 GMT

I assume we are looking only at login events.
Note that authenticating to your screensaver after timeout should generate the necessary login eventz

Re: "pep show user query usr" - Time Left

enrico_azzolin — Mon, 07 Oct 2024 13:09:56 GMT

The point is that some users that have an entry still vaild on the PDP gateway, for some reason lose their entry on the PEP gateway for timeout. I'm trying to understand why this happens and why the entry on the PEP gateway is not automatically refreshed.