fix(KAAP-2297): retry federation auth redirects, surface retryable session errors - #71
Open
mridulgain wants to merge 1 commit into
Open
fix(KAAP-2297): retry federation auth redirects, surface retryable session errors#71mridulgain wants to merge 1 commit into
mridulgain wants to merge 1 commit into
Conversation
…sion errors The keystonefed connector's federation auth call intermittently gets a 302 redirect instead of a token (KAAP-2297), which today surfaces as an opaque 500. Add a bounded retry (3 attempts, 150ms apart) since the redirect has so far only reproduced as a transient session-lookup miss, and classify a still-redirecting response as a distinct connector.RetryableError so the server renders 401 with an actionable message instead of a generic "Failed to authenticate" 500. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mridulgain
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Keystone's federation auth endpoint intermittently returns a 302 redirect instead of a token, which the
keystonefedconnector today surfaces as an opaque 500.Most real occurrences of this redirect resolve transparently within the retry window, so users no longer hit an error page at all for the common case. When it does exhaust retries, the message tells the user to just log in again instead of looking like a server failure.
Test plan
🤖 Generated with Claude Code