How to change the default value of "accessTokenValiditySeconds" and "refreshTokenValiditySeconds" for UAA in TCPF

Products

• VMware Tanzu Application Service

Issue/Introduction

TPCF UAA token validity settings currently have the following default values:

• Access token validity: 43,200 seconds
• Refresh token validity: 2,592,000 seconds

However, user might need to change these default values for some reason (e.g. request from security team). The "Access token validity" and "Refresh token validity" properties are configured in /var/vcap/jobs/uaa/config/uaa.yml file on uaa instance in TCPF, which take default values and are not configurable on TPCF tile settings (Ops Manager web UI). 

uaa/c5af7bb5-####-d5dbecacc1be:~$ sudo cat  /var/vcap/jobs/uaa/config/uaa.yml 
......
jwt:
  token:
    queryString:
      enabled: true
    revocable: false
    policy:
      accessTokenValiditySeconds: 43200
      refreshTokenValiditySeconds: 2592000
      global:
        accessTokenValiditySeconds: 43200
        refreshTokenValiditySeconds: 2592000
......

Resolution

There are 2 ways to change default values of accessTokenValiditySeconds and refreshTokenValiditySeconds in /var/vcap/jobs/uaa/config/uaa.yml at the moment.

1) Manually update accessTokenValiditySeconds and refreshTokenValiditySeconds parameters in /var/vcap/jobs/uaa/config/uaa.yml file on all uaa instances for a TPCF deployment followed by command "monit restart uaa". However, the change will not survive when uaa instance is updated for recreated as it will revert back to the default values.

 

2) Add a BOSH runtime config as described in this KB article to deploy a pre-start-script job on uaa instance to make the change automatically. The change will survive even if uaa instance got updated and recreated.

Following is a sample of the BOSH runtime config to update accessTokenValiditySeconds and refreshTokenValiditySeconds parameters in /var/vcap/jobs/uaa/config/uaa.yml file.

releases:  
- name: os-conf   
  version: 23.0.0 

addons:
- name: uaa-prestart-config
  jobs:      
  - name: pre-start-script        
    release: os-conf        
    properties:          
      script: |-
         #!/bin/bash
         if [ -f /var/vcap/jobs/uaa/config/uaa.yml ]; then
             cp /var/vcap/jobs/uaa/config/uaa.yml /var/vcap/jobs/uaa/config/uaa.yml.backup
             sed -i 's/\(accessTokenValiditySeconds:\).*/\1 14400/; s/\(refreshTokenValiditySeconds:\).*/\1 604800/' /var/vcap/jobs/uaa/config/uaa.yml 
         fi
  include:
    deployments: [cf-e8f6####1d78]
    instance_groups: [uaa]

 

Note: replace cf-e8f6####1d78 with real BOSH deployment name on your TPCF foundation