ARTIFACTORY: How Expired Access Token Cleanup Works in Artifactory

Overview

JFrog access tokens are time-bound credentials: each one is issued with an expiration time and stops working once that time is reached. In addition to this natural expiration, the JFrog Access microservice also runs a scheduled internal process that regularly clears out expired tokens.

This article explains how that process works and how administrators can view or adjust its settings.

How Token Expiration Works

There are Two Distinct Mechanisms:

1. Natural expiry (JWT-level → no job involved)

Every access token is a JWT with an expiry (exp) claim. Once that time passes, the token simply stops being accepted during authentication; This is standard JWT validation that requires no cleanup job, as documented here:

"A token with an expiry specified will lapse automatically upon reaching its expiry period."

2. Scheduled revocation job (Access-service level)

Separately, JFrog Access runs a background job that revokes/clears expired token records.

This job runs once every hour by default and is controlled by the following property in Access YAML configuration documentation:

XML

task:
  revoke-expired-tokens-cron: "0 0 0/1 * * ?"  # cron expression defining when the
"revoke expired token" job should run. disable the job by using "-". when the default
value is set the seconds & minutes of the cron job are randomly generated.

This cron expression defines when the "revoke expired token" job runs. By default, it runs once an hour (JFrog randomizes the exact seconds/minutes per deployment so all nodes in a cluster don't fire simultaneously). You can change the schedule or disable the job entirely by setting the value to "-". (Note - it is recommended to avoid changing it manually; please reach out to JFrog support if needed).

Configuration Reference

On top of the cron job above, there are several related properties that affect what to clean up in the first place:

• persistent-expiry-threshold - The Persistency Threshold (default 10800 sec = 3 hours) - it basically defines the minimal expiry value a token must have to be saved in the database at all. Short-lived tokens below this threshold are never persisted, which means they won't be eligible for the cron job.

• revocable-expiry-threshold - (default 21600 = 6 hours) - a token with expiry shorter than this threshold cannot be revoked; it simply expires when it reaches its configured expiry. (See the Relationship between the two thresholds for further insights.)

• security.token.delete-with-user - (default true) - deletes a user's tokens when that user is deleted, independent of the cron job.

Note:

JFrog strongly recommends keeping this property value set to true for security reasons.

All properties above live in the Access YAML configuration file: $JFROG_HOME/artifactory/var/etc/access/access.config.latest.yml

and can be modified accordingly; However, we strongly recommend confirming the relevant documentation to understand the relationship between the properties and their implications.