Token Lifespan Configuration Guide

This document provides comprehensive guidelines for configuring OAuth2 token lifespans in EF IAM according to industry security standards and best practices. The configuration follows recommendations from RFC 6749, OWASP security guidelines, and modern cybersecurity frameworks.

Industry Standard Token Lifespans

Based on security research and industry best practices, the following token lifespans are recommended:

Security Rationale

• Short Access Tokens (15 minutes): Minimizes the impact of token theft or interception

• Medium Refresh Tokens (7 days): Balances security with user experience

• Activity-Based Extension: Sessions extend with user activity, expire with inactivity

Configuration Settings

Realm-Level Configuration

We are going to implement following setting for Access and Refresh token lifespan as per RFC 6749, RFC 6750

Access Token Settings

Access Token Lifespan: 15m (900 seconds)
Access Token Lifespan for Implicit Flow: 15m (900 seconds)
Client Login Timeout: 30m (1800 seconds)
Login Timeout: 30m (1800 seconds)

Session Settings (Controls Refresh Token Lifespan)

SSO Session Idle Timeout: 7d (604800 seconds)
SSO Session Max Lifespan: 7d (604800 seconds)
Client Session Idle Timeout: 7d (604800 seconds)
Client Session Max Lifespan: 7d (604800 seconds)

Client-Level Configuration

Access Token Lifespan: 15m

IAM Admin Console Configuration:

1. First check the lifespan of your access and refresh token. This is the Postman API call to generate admin token, you can see that it has lifespan for both tokens is 30 minutes.
   

   

2. Now, go to your targeted realm in EF IAM and then click on Realm Settings under Configure tab (in this example its Expertflow).
   

   

3. Click on Tokens tab in Realm Settings. Change all the setting as per configurations given below:
   

   

4. Click on Session tab in Realm Settings. Change all the setting as per configurations given below:
   

   

5. Now, click on Clients tab under Manage setting on left panel, then click on cim.
   

   

6. Click on Advanced tab in cim settings
   

   

7. Scroll down until you see Advanced Settings. Under which we can see Access token lifespan setting. This setting modifies the lifespan of our access token. Modify it as per configuration given below:
   

   

Verification and Testing

Verify Token Configuration

1. Test Token Endpoint Response

curl -X POST \
  http://localhost:8080/realms/{realm-name}/protocol/openid-connect/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=password&client_id={client-id}&username={username}&password={password}'

2. Expected Response Format

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 900,
  "refresh_expires_in": 604800,
  "refresh_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "not-before-policy": 0,
  "session_state": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "scope": "profile email"
}

3. Key Verification Points

   • expires_in: Should be 900 (15 minutes)

   • refresh_expires_in: Should be 604800 (7 days)

Token Refresh Flow Testing

# Use refresh token to get new access token
curl -X POST \
  http://localhost:8080/realms/{realm-name}/protocol/openid-connect/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=refresh_token&client_id={client-id}&refresh_token={refresh-token}'

Detailed Setting Explanations

Access Token Settings

Session Settings (Refresh Token Control)

Compliance and Standards

Industry Standards Compliance