Access token generated by Management API has too long lifetime

[char000]

Every bug report should have precise description and reproduction steps; console traces or source code references are appreciated.

For assistance requests, contact Azure support or submit a post on Stack Overflow. We don't provide support through GitHub Issues. Feature requests can be raised on the Azure Feedback Forum.

Description

We are using signin delegation for signing user into developer portal.

1. After user is authenticated by our backend, our backend generates SAS token with lifetime of 3 minutes and then redirect the user to developer portal (/signin-sso) with that SAS token.

2. Developer portal uses SAS token to call management API endpoints to get a list of products/apis, etc

3. Management API endpoints (specifically, this API) returns json response along with a new token in Ocp-Apim-Sas-Token header with lifetime of 1hr

We would like to have expiry of token generated in step 3 to be 15-20min.

Support request ID: 2109290060001844

[ghost]

@char000, thank you for opening this issue. We will triage it within the next few business days.

[azaslonov]

Hi @char000, right this is not possible to configure the token lifetime currently. I'm leaving it as a feature request.

[ghost]

@char000, thank you for requesting this feature.

[char000]

@mikebudzynski Is there any update about this request?

[KIT-GregC]

@mikebudzynski Is there any update about this request?

I would like to see this feature too.