Console paths

The routes under /console that sign an administrator in to a tenant, keep that administrator’s tokens on the server and forward the console’s calls to the admin API. The browser holds nothing but a session cookie.

Each block is a command that was run and the output it printed. The pages are in the order the requests ran, so a cookie one page sets is the one the next page sends.

How they were captured is in How the transcripts are captured and checked.

Pages

• GET /console/auth/login
• The tenant's own sign-in
• GET /console/auth/callback
• The gateway is a confidential client
• GET /console/auth/callback, refused
• GET /console/auth/callback, restarted
• GET /console/api/session
• GET /console/api/tenants/{tenant}/discovery, GET…
• GET /console/api/admin/tenants/{tenant}/subjects
• PATCH /console/api/admin/tenants/{tenant}/subjects/{id}
• POST …/subjects, refused as cross-site
• POST …/subjects, refused for another principal
• A path that escapes /admin/
• A refresh
• A refresh that cannot take the lock
• A refresh the server refuses
• POST /console/auth/logout
• Following the logout redirect
• GET /console/
• What these runs do not show