End sessions and inspect sign-in events

For: cluster and tenant administrators.

Review session lifetime, revoke sessions and identify authentication audit events.

Sessions

A session lasts seven days, whichever way it signed in, the CLI's too. Access, Sessions lists every signed-in browser, how it signed in, from which address and when it was last used; everyone sees their own under Settings, Account.

oz0 user sessions          # everyone's
oz0 user sessions kim
oz0 user signout kim       # every session of kim's
oz0 user signout kim --session 3f9a0c...

Changing a password, removing it, resetting the second step, disabling the account and removing it all sign the account out everywhere.

• The session cookie is this host's alone. It is __Host-oz0_session: browsers keep it only from this server over HTTPS, for every path, and no other host of the same site (another subdomain) can set or replace it. It is HttpOnly and SameSite=Strict. A request it signs that can change something must have a JSON or protobuf body, and when the browser says where it came from (Sec-Fetch-Site, or else Origin), it must come from this server's own pages; anything else is refused with 403. After an upgrade to this cookie, everyone signs in again once.

In the audit log

Sign-in changes are in the audit log: user.create (a password account, by whoever made it), user.password.set (who set it, whether it was the account's own change, and whether it was generated; never the password), user.password.remove, oidc.provider.set and oidc.provider.remove, mfa.policy (in the tenant's log for a tenant's policy), mfa.enrol, mfa.disable, mfa.reset, mfa.recovery_codes and mfa.lockout, session.end, user.link.allow and user.unlink, and what a provider did at a sign-in, as oidc:<id>: user.create, user.link, user.role, member.set and member.remove.

Accounts from a directory add account.create, account.groups, account.disable, account.enable and account.removed, with member.remove, apikey.revoke and apikey.finding in each tenant's log, as the provisioner or admin who made the call (provisioner:<name>), and provisioner.tenant.allow and provisioner.tenant.remove in the tenant's log; a provisioner's own entries are provisioning.*, and its certificates' provisioner.issue, provisioner.renew, provisioner.disable and provisioner.enable.

MCP clients add mcp.client.authorized and mcp.client.denied (the person's decision at the consent page, with the client and its redirect host), mcp.client.revoked (by the person, an admin, the client itself, or the server when a code or a refresh token was used twice) and tenant.mcp_clients (the allowlist).