ARTIFACTORY: How to change the validity of Identity token based on your company policy

Identity Token

The user profile now enables users to generate identity tokens. Any user can create a user identity token for themselves via the UI or via REST API. Identity tokens are scoped tokens, which means that they provide limited and focused permissions, making them more secure and, therefore, preferable to API keys. In addition, when a user is deleted/disabled, their tokens are also revoked. To learn more, see Identity Token

When an admin user generates an Identity token via the UI as per the documentation, the token comes with no expiry as below.

User-added image

We can configure this setting in Artifactory in order to create an Identity token for non-admin users with specific expiry based on our requirements.

Steps to be followed to configure the setting related to the Identity token which should have the specific expiry time as mentioned.

Take a backup of the current $Artifactory_home/etc/access/access.config.latest.xml file.
Update the default-expiry value in the $Artifactory_home/etc/access/access.config.latest.yml file. Please refer to the documentation.

The token expiry value should be set in seconds. In the below example, we are configuring the user token to expire in 90 days (i.e 7776000 secs = 90 days).

token:
  default-expiry: 7776000

Sample access.configuration,latest.yml file:

---
token:
  default-expiry: 7776000
federation:
  inbound:
    service-id-mapping:
    - from: "jfrou@*"
      to: "jfrou@01XXXXXe4dy"
    - from: "jfint@*"
      to: "jfint@01gXXXXXXt51"
    - from: "jfcon@*"
      to: "jfcon@01XXXXXXX1t51"
    - from: "jfevt@*"
      to: "jfevt@01gXXXXXXXX1t51"
    - from: "jfmd@*"
      to: "jfmd@01gk3XXXXXXX51w"
    - from: "jfrt@*"
      to: "jfrt@01gkXXXXXXXXXXdqh"
    - from: "jfob@*"
      to: "jfob@01XXXXXXXXXXdqh"
    - from: "jffe@*"
      to: "jffe@000"
licenses:
- server-name: "art1"
  key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
schema-version: 2

Rename $Artifactory_home/etc/access/access.config.latest.yml to $Artifactory_home/etc/access/access.config.import.yml.
Perform a rolling restart of the Artifactory instance.
Now login as the non-admin user and generate an Identity token. It should be having the expiry time which we configured in the access configuration file. For example, I have configured here the default-expiry to 7776000 seconds(i.e. 90 days).

Note: This change applies only to non-admin users. To update the configuration in JFrog SaaS please reach out to JFrog support



Note
  
In the later 2023 versions, API Keys will be deprecated altogether and the option to use them will no longer be available. You can refer to our  Artifactory release notes for more information)