Feature #16678: Default lifetime for tokens issued through login - Arvados

Actions

Copy link

Feature #16678

closed

Default lifetime for tokens issued through login

Added by Peter Amstutz over 3 years ago. Updated over 3 years ago.

Status:

Resolved

Priority:

Normal

Assigned To:

Lucas Di Pentima

Category:

API

Target version:

2020-08-26 Sprint

Story points:

Release:

Arvados 2.1.0

Release relationship:

Auto

Description

Add a configuration where tokens issued through web login have a default lifetime. An expiration time of 8 or 12 hours implements a policy where users are required to log in again each day, and limits the amount of time an attacker could make use of a stolen token. The token is prevented from manipulating other tokens (i.e. getting other tokens or creating a new token without an expiration).

Document this feature in the admin section.

Subtasks 1 (0 open — 1 closed)

Related issues

Actions

Copy link

Updated by Peter Amstutz over 3 years ago

Category set to API
Description updated (diff)

Actions

Copy link

Updated by Peter Amstutz over 3 years ago

Description updated (diff)

Actions

Copy link

Updated by Peter Amstutz over 3 years ago

Related to Idea #16520: GxP Qualification added

Actions

Copy link

Updated by Peter Amstutz over 3 years ago

Target version set to 2020-08-26 Sprint

Actions

Copy link

Updated by Peter Amstutz over 3 years ago

Description updated (diff)

Actions

Copy link

Updated by Lucas Di Pentima over 3 years ago

Assigned To set to Lucas Di Pentima

Actions

Copy link

Updated by Lucas Di Pentima over 3 years ago

Status changed from New to In Progress

Actions

Copy link

Updated by Peter Amstutz over 3 years ago

Release set to 25

Actions

Copy link

Updated by Lucas Di Pentima over 3 years ago

Updates at 00e16fb - branch 16678-login-tokens-lifetime-config
Test run: developer-run-tests: #2026

Sets new config knob Login.TokenLifetime that takes a Duration value that will be used to set the expires_at field on ApiClientAuthorization resources. Its default value is zero meaning that the feature is disabled.
- Now that I see it with fresh eyes after the weekend, it may be more consistent to name it something like Login.TokenTTL
On tokens created from a login flow:
- Set the token expiration date if configured.
- Set the is_trusted flag to false even if coming from trusted URLs (workbenches) to avoid the user to create new tokens.
Adds rake tasks db:check_long_lived_tokens and db:fix_long_lived_tokens to allow the site admin to migrate from a previous token policy (eg: unexpiring tokens) to a more strict policy wrt to preexistent tokens.