TERRAFORM_OIDC_IDP_SESSION_EXPIRY extend expiry time

[EzekielHub]

Hey i have a question.
i am running terrareg on a Kubernetes cluster and i am using Atlantis to apply terraform code directly from pull request. But i also have allow_undefined_Access to false. Meaning i need to do terraform login public_url. and then i get a token. My question is, is it possible to create a token that is valid for atleast a year. so my Atlantis deployment can always pull from terrareg. i tried setting the TERRAFORM_OIDC_IDP_SESSION_EXPIRY to 31536000 but this don't work and after 1 hour the token is no longer valid. Is there a maximum value for the TERRAFORM_OIDC_IDP_SESSION_EXPIRY variable?

This seems to do something but after an hour the token till becomes unvalid
result of [SELECT * FROM terraform_idp_access_token;]

i believe he didn't delete the entries yet because the expiry date is larger that the current date. But this doesn't mean that the token is still valid?

`

            if self.SHOULD_EXPIRE:
                # Delete any old sessions
                conn.execute(sqlalchemy.delete(self.table).where(self.table.c.expiry < datetime.now()))
                transaction.commit()`

python timedate seconds

Let's allows values between 0-86399.
so i change this line

expiry=(datetime.now() + timedelta(seconds=terrareg.config.Config().TERRAFORM_OIDC_IDP_SESSION_EXPIRY))

to

expiry=(datetime.now() + timedelta(days=terrareg.config.Config().TERRAFORM_OIDC_IDP_SESSION_EXPIRY))
and rebuilt the image now i will wait for an hour to see it this affects anything and TERRAFORM_OIDC_IDP_SESSION_EXPIRY to 365

This doesn't fix it, after 1 hour the token is no longer valid. Any idea how to make this possible?

[MatthewJohn]

Hey @EzekielHub,

This is an interesting issue.

Looking at some of these points:

The expiry is used in 3 places:

• In the expiry column for the IDP token tables (as you've seen in the BaseIdpDatabase class). If the row is still present in the table after one hour, then I assume this isn't related.
• As the 'authorization_code_lifetime' argument to pyop 'AuthorizationState'
• As the 'id_token_lifetime' argument to pyop 'Provider'

With regards to the timedelta, from testing, values for seconds appear to be valid higher than those in your screenshot:

>>> datetime.timedelta(seconds=365*24*60*60)
datetime.timedelta(days=365)

I will continue taking a look, but I assume it's related to the pyop classes.

[MatthewJohn]

Ah, I've seen that access_token_lifetime defaults to 1 hour and this was missed in the implementation - I suspect that this might fix the issue.
I can create a branch with this and see how if it fixes your issue? I'm afraid I don't have much time right this second to fully test it

Thanks
Matt

[MatthewJohn]

I've created a branch 483-terraform_oidc_idp_session_expiry-extend-expiry-time with the proposed fix :)

[EzekielHub]

Hi @MatthewJohn

Thanks for the quick action. i checked the 483 branch now and noticed the change

it works.
now i will wait one hour to see if it really works.

[MatthewJohn]

Hey - That's wonderful :) Let me know that it works as expected after the hour - I'll add some tests and look at merging :)

Thanks
Matt

[EzekielHub]

hi @MatthewJohn

yes it works has expected. it been about 4 hours now and the credentials are still valid.
Cheers
Ezekiel

[MatthewJohn]

This has now been merged and CI should release within the next 30m :)

Thanks again for raising and apologies for the issue!