|
|
|
participantToken lifetime 1 Year, 5 Months ago
|
Karma: 16
|
|
Once we authenticate against the TokenService, we get a participantToken. I was wondering what is the default lifetime of this token and if we can extend or reduce this lifetime by configuration...
|
|
|
|
|
|
|
The administrator has disabled public write access. |
|
|
|
Re:participantToken lifetime 1 Year, 5 Months ago
|
Karma: 28
|
|
The token in itself does not expire. It only contains a timestamp (of when it was issued) that each application can read and then decide whether it's time to re-challenge the user with an authentication dialog, or whatever may be appropriate.
So you have to take a look on a case by case basis.
Thanks,
Pascal.
|
|
|
|
|
|
|
The administrator has disabled public write access. |
|
|
|
Re:participantToken lifetime 1 Year, 5 Months ago
|
Karma: 16
|
|
Pascal, thanks for the reply. This sounds like a potential security threat if the token cannot expire (implicitly I consider the token as an authentic session). Someone (malicious) could exploit this to perform actions on the TMS for example...
|
|
|
|
|
|
|
The administrator has disabled public write access. |
|
|
|
Re:participantToken lifetime 1 Year, 5 Months ago
|
Karma: 28
|
|
If handled incorrectly by the service or application, yes, definitely.
In fact, a quick review of the TMS code seems to indicate that it does not check for expiration... (Patches welcome!)
Thanks,
Pascal.
|
|
|
|
|
|
|
The administrator has disabled public write access. |
|
|
|
Re:participantToken lifetime 1 Year, 5 Months ago
|
Karma: 3
|
|
where is the wsdl for the token service?
|
|
|
|
|
|
|
The administrator has disabled public write access. |
|
|
|
Re:participantToken lifetime 1 Year, 5 Months ago
|
Karma: 16
|
|
|
|
|
|
|
|
|
The administrator has disabled public write access. |
|
FORUMS 
Post Reply
Favoured: 0
Post Reply
