Skip to content

Recovery emails / links do not respect token_expiry #9671

@fullykubed

Description

@fullykubed

Describe the bug

No way to change token expiration time window from the default 30 minutes.

This is despite the example flows and API documentation stating that the email stage's
token_expiry property should be able to change the token expiry.

To Reproduce

Here is an example stage that demonstrates the issue.

resource "authentik_stage_email" "email" {
  name                     = "example-recovery-email"
  use_global_settings      = true
  activate_user_on_success = true
  token_expiry             = 60
  subject                  = "Reset your ${var.organization_name} account!"
}
  1. Deploy the above and integrate it into a recovery flow.
  2. Try to issue a recovery email or generate a recovery link.
  3. Check the authentik_core_token table. Notice that the expiration time is only 30 minutes in the future.

Expected behavior

The expiration time of tokens should match the configured token_expiry.

Version and Deployment (please complete the following information):

  • authentik version: 2024.4.2
  • Deployment: helm

Additional Context:

It seems weird that token_expiry is on the stage rather than the flow, especially since we can generate recovery links without emails. Perhaps this is just an old property that needs to be deleted? If so, it would be ideal to be able to set expiration windows on recovery links via some other mechanism.

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingbug/confirmedConfirmed bugs

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions