Awx: New outh2 token which generating from /api/o/token cannot apply new expiry seconds

[noname1314]

ISSUE TYPE

• Bug Report

COMPONENT NAME

• API

SUMMARY

New outh2 token which generating from /api/o/token cannot apply new expiry seconds setting

ENVIRONMENT

• AWX version: 3.3.1 (latest version which released on 25/Oct/2018)
• AWX install method: Linux (Centos 7)
• Ansible version: 2.7.1
• Operating System: Windows 10

• Web Browser: Chrome

• Authentication setting (From api/v2/settings/):
  {
  "SESSION_COOKIE_AGE": 1800,
  "SESSIONS_PER_USER": -1,
  "AUTH_BASIC_ENABLED": true,
  "OAUTH2_PROVIDER": {
  "ACCESS_TOKEN_EXPIRE_SECONDS": 86400,
  "AUTHORIZATION_CODE_EXPIRE_SECONDS": 1800
  },
  "ALLOW_OAUTH2_FOR_EXTERNAL_USERS": false,
  "AUTHENTICATION_BACKENDS": [
  "awx.sso.backends.TACACSPlusBackend",
  "django.contrib.auth.backends.ModelBackend"
  ],
  "SOCIAL_AUTH_ORGANIZATION_MAP": null,
  "SOCIAL_AUTH_TEAM_MAP": null,
  "SOCIAL_AUTH_USER_FIELDS": null
  }

STEPS TO REPRODUCE

1. Create application and copy client id and client secret.
2. Request new OAuth2 token by postman / curl with login credential (normal user), client id and secret
3. A token will be generated if API call successful

EXPECTED RESULTS

New OAuth2 token should be expired after 1 day

ACTUAL RESULTS

New OAuth2 token still remain the old setting as default one, which will expire after 1000 YEARS!

ADDITIONAL INFORMATION

[rooftopcellist]

@noname1314 good find. I tested this out and the ACCESS_TOKEN_EXPIRE_SECONDS setting change is picked up when creating a token at api/v2/tokens, but not when doing a curl/postman to api/o/tokens.

This is because that setting is not automatically updated in django-oauth-toolkit. One work-workaround here is adding the following setting to settings.py, then restarting awx services.

OAUTH2_PROVIDER = {'ACCESS_TOKEN_EXPIRE_SECONDS': 86400,
                   'AUTHORIZATION_CODE_EXPIRE_SECONDS': 600}

I am looking in to making sure this setting gets applied as expected.

[noname1314]

@noname1314 good find. I tested this out and the ACCESS_TOKEN_EXPIRE_SECONDS setting change is picked up when creating a token at api/v2/tokens, but not when doing a curl/postman to api/o/tokens.

This is because that setting is not automatically updated in django-oauth-toolkit. One work-workaround here is adding the following setting to settings.py, then restarting awx services.

OAUTH2_PROVIDER = {'ACCESS_TOKEN_EXPIRE_SECONDS': 86400,
                   'AUTHORIZATION_CODE_EXPIRE_SECONDS': 600}

I am looking in to making sure this setting gets applied as expected.

@rooftopcellist Work-around workable. If possible, please align the authorization token setting into GUI setting instead of setting.py / API setting.

[daczka92]

@noname1314 good find. I tested this out and the ACCESS_TOKEN_EXPIRE_SECONDS setting change is picked up when creating a token at api/v2/tokens, but not when doing a curl/postman to api/o/tokens.

This is because that setting is not automatically updated in django-oauth-toolkit. One work-workaround here is adding the following setting to settings.py, then restarting awx services.

OAUTH2_PROVIDER = {'ACCESS_TOKEN_EXPIRE_SECONDS': 86400,
                   'AUTHORIZATION_CODE_EXPIRE_SECONDS': 600}

I am looking in to making sure this setting gets applied as expected.

in wchich settings.py should we add those lines? i still have same problem.
as i understand api/v2/tokens and api/o/token/ are different tokens with different purposes.

[noname1314]

@noname1314 good find. I tested this out and the ACCESS_TOKEN_EXPIRE_SECONDS setting change is picked up when creating a token at api/v2/tokens, but not when doing a curl/postman to api/o/tokens.
This is because that setting is not automatically updated in django-oauth-toolkit. One work-workaround here is adding the following setting to settings.py, then restarting awx services.

OAUTH2_PROVIDER = {'ACCESS_TOKEN_EXPIRE_SECONDS': 86400,
                   'AUTHORIZATION_CODE_EXPIRE_SECONDS': 600}

I am looking in to making sure this setting gets applied as expected.

in wchich settings.py should we add those lines? i still have same problem.
as i understand api/v2/tokens and api/o/token/ are different tokens with different purposes.

/etc/tower/settings.py and please restart ansible tower service by ansible-tower-service restart

[mbzieba]

This is still problem for us.
Can anyone fix it?

[rebeccahhh]

related to #4865

[fosterseth]

There is a fix for this downstream, and the changes will make its way to awx devel in the near future.

[kdelee]

The test cases covered in https://github.com/ansible/awx/issues/4710#issuecomment-540759480 apply to this as well, so this is ready to close.

Please reach out of fixes are not working for you.

[sdwru]

Refresh Tokens do not expire for us.

Using AWX v10.0.0

https://x.x.x.x/api/v2/settings/all/

"OAUTH2_PROVIDER": {
        "ACCESS_TOKEN_EXPIRE_SECONDS": 10,
        "REFRESH_TOKEN_EXPIRE_SECONDS": 10,
        "AUTHORIZATION_CODE_EXPIRE_SECONDS": 600
    },



md5-6058ad957ad9b0affb83881b75cf0a83



OAUTH2_PROVIDER = {'ACCESS_TOKEN_EXPIRE_SECONDS': 10,
                    'REFRESH_TOKEN_EXPIRE_SECONDS': 10,
                   'AUTHORIZATION_CODE_EXPIRE_SECONDS': 600}

and restarting the container.