Search code examples
websphereibm-mobilefirst

How to test the customed token expiration in MFP 8.0

I have this requirement to modify the token expiration value to 600 (seconds) or 10 minutes.

Steps:

  1. Log-in to MFP Admin Console.

  2. Navigate to my web-app > Security Tab > Edit the "Maximum Token-Expiration Period (seconds)" edit the input text to 600

  3. Tested in POSTMAN by adding this endpoint http://localhost:9060/mfple/api/az/v1/token

The result is the expiration field is still 3599 seconds.

What am I missing? Please help. :(

Solution

  • Configurable OAuth token timeouts are valid only when accessed via mobile or web SDKs. In that scenario , you get an OAuth token with a timeout, which is the lower of what you configured in the security tab or the remaining expiry period of the security check that is mapped to the scope.

    When accessing via REST endpoints directly, you will get an OAuth token that is valid for 1 hour ( 3600 seconds). This timeout is not modifiable.