Description of problem: As a user, I would like more transparency and features around using token for the cli. Namely: - It isn't obvious how long my token will last - It isn't obvious if I can change my token expiration - A longer default expiration would be nice
- It isn't obvious how long my token will last We can display that - It isn't obvious if I can change my token expiration As an end user, you cannot - A longer default expiration would be nice Settable by the cluster admin, I don't think we'd go longer than 24 hours by default.
I was running my tests and it started failing after 24 hrs, Server should extend the expiry date on token if its in use. Its like a session, if its in use extend it.
> Server should extend the expiry date on token if its in use. Its like a session, if its in use extend it. No, the expiration is intended to ensure that the authenticated user is still present. Reaffirming the identity with the configured identity provider does that, while extending the token does not.
Checked on dev-preview-int, and the 31 days token still not take effect.
This bug is still in the MODIFIED state - I will move it to ON_QA when the configuration has been applied to INT/STG.
Can you please verify this in STG now?
Checked with dev-preview-stg, and the 31 days token still not take effect. [root@dev-preview-stg-master-defb2 ~]# oc get oauthaccesstokens msaw4-g4TF60eUxKvtl-_1gv1f41l254WIn9lyVLCNM NAME USER NAME CLIENT NAME CREATED EXPIRES REDIRECT URI SCOPES msaw4-g4TF60eUxKvtl-_1gv1f41l254WIn9lyVLCNM wjiangjay openshift-web-console 2016-05-16 02:28:20 +0000 UTC 2016-05-17 02:28:20 +0000 UTC https://console.dev-preview-stg.openshift.com/console/oauth And the master-config have 2 tokenConfig fields, and seems the second take effect: oauthConfig: alwaysShowProviderSelection: True templates: error: /etc/openshift-online/ui-extensions/custom-templates/oauth-error-dev.html providerSelection: /etc/openshift-online/ui-extensions/custom-templates/provider-selection-dev.html tokenConfig: accessTokenMaxAgeSeconds: 2678400 authorizeTokenMaxAgeSeconds: 300 assetPublicURL: https://console.dev-preview-stg.openshift.com/console/ grantConfig: method: auto identityProviders: - challenge: false login: true mappingMethod: lookup name: github provider: apiVersion: v1 clientID: 64adcbe3d8c7f05fdce6 clientSecret: fae839769da535ec778edfe1a500cb0c152acd58 kind: GitHubIdentityProvider masterCA: ca.crt masterPublicURL: https://api.dev-preview-stg.openshift.com masterURL: https://internal.api.dev-preview-stg.openshift.com sessionConfig: sessionMaxAgeSeconds: 3600 sessionName: ssn sessionSecretsFile: /etc/origin/master/session-secrets.yaml tokenConfig: accessTokenMaxAgeSeconds: 86400 authorizeTokenMaxAgeSeconds: 500
Should be corrected in INT and STG per https://github.com/openshift/online/issues/138#issuecomment-219539660
Checked with dev-preview-stg, and now the token max age is 31 days
And dev-preview-int is also 31 days max age for token