-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Description
Describe the bug
No way to change token expiration time window from the default 30 minutes.
This is despite the example flows and API documentation stating that the email stage's
token_expiry property should be able to change the token expiry.
To Reproduce
Here is an example stage that demonstrates the issue.
resource "authentik_stage_email" "email" {
name = "example-recovery-email"
use_global_settings = true
activate_user_on_success = true
token_expiry = 60
subject = "Reset your ${var.organization_name} account!"
}- Deploy the above and integrate it into a recovery flow.
- Try to issue a recovery email or generate a recovery link.
- Check the
authentik_core_tokentable. Notice that the expiration time is only 30 minutes in the future.
Expected behavior
The expiration time of tokens should match the configured token_expiry.
Version and Deployment (please complete the following information):
- authentik version: 2024.4.2
- Deployment: helm
Additional Context:
It seems weird that token_expiry is on the stage rather than the flow, especially since we can generate recovery links without emails. Perhaps this is just an old property that needs to be deleted? If so, it would be ideal to be able to set expiration windows on recovery links via some other mechanism.