Partial render of sessions due to timezones

[klizhentas]

Have a question? Please use Our Forum

What happened:

In case if the session end event does not end up being present in the requested range
for the sessions in the user interface, the sessions are rendered incomplete, because
not all session events are fetched.

What you expected to happen:

Regardless of the timezone, the end event should be included for the sessions.

How to reproduce it (as minimally and precisely as possible):

Create a session, make sure the session is longer lasting. Tweak the timezone to include the session start, but exclude session end.

The session will render with incomplete results - no duration or playback will be available

Environment:

• Teleport version (use teleport version):
  4.0
• Tsh version (use tsh version):
  4.0
• OS (e.g. from /etc/os-release):

Browser environment

• Browser Version (for UI-related issues):
• Install tools:
• Others:

Relevant Debug Logs If Applicable

• tsh --debug
• teleport --debug

[klizhentas]

@kontsevoy @benarent my proposal is always use UTC on the client for selection purposes to avoid confusion like this, instead of relying on the browser client timezone. The session dates should always be displayed in UTC as well.

[klizhentas]

I'm currently thinking on the appropriate fix for the backend as well.

[alex-kovoy]

We use UTC format in web ui when making session queries, so a user needs to make sure that browser/OS timezone is correctly configured. For example, if you are on the east cost but your OS/Browser uses Western time zone, then your search query wont yield the expected results.

[klizhentas]

My point is that we should ignore the browser timezone and always display and query in UTC. We should also make it clear that all times are in UTC. This is quite common for the server/infrastructure software.

[benarent]

+1 for the solution. We already have UTC defined for the session list, and the date pickers doesn't define time so working on the backend fix seems appropriate. No need to update the UI for now.

[klizhentas]

well, UI has to be updated in the sense that it has to stop using local timezone, and always use UTC, what's not the case it seems like.

[alex-kovoy]

In case if the session end event does not end up being present in the requested range
for the sessions in the user interface, the sessions are rendered incomplete, because
not all session events are fetched.

Based on these repro steps it looks like the issue is with the way we handle stored sessions in general. If session.end event is outside of requested range, the session wont appear in the stored session list. Currently this is expected behavior because fetch request wont return this event.

[alex-kovoy]

In other words, there must be session.end event to mark a session as completed even if its session.start event falls into requested range.

[klizhentas]

@kontsevoy to confirm with you, @alex-kovoy mentioned that the new UI won't actually have sessions tab for plabyack - as long as session.end event shows up in the audit log, users will be able to play it back, otherwise they could try to join. Is that correct? In this case the fix on the backend will not be necessary as there will be no ambiguity.

However, there is still a question on how to reliably determine on whether the session is active or not, do we use some other method of determining it @alex-kovoy ?

[alex-kovoy]

@klizhentas there is a separate endpoint just for active sessions and this is not related to events. So yes, we can reliably display the list of active sessions.

[kontsevoy]

@klizhentas yes this makes sense to me. But 4.0 does not currently offer "join" button at all, just FYI. I created #2839 for this.

I don't have anything to offer regarding the missing session_end events. This is a software engineering/design limitation. Either have an internal API which returns the list of active sessions, or assume that any session_start events older than X hours indicate a completed session?

[klizhentas]

Moving this to 4.2 because new UI changes should address this issue - the playback will be available only on the "session.end" event.

[benarent]

Closing this ticket and going to reference it into #2800 so we've one ticket for this.