Q:

Set Token Validation Period in Identity Server 4

What is the mechanism for setting a token validation period in Identity Server 4? Can the validation period vary for different tokens?
The Identity Server 4 documentation at http://docs.identityserver.io/en/dev/ shows a AuthorizationEndpoint with a property max_age, which is what I think I want, but the documentation does not really show it it inter-operates with the quickstart code for IdentityServerWithAspNetIdentity.

A:

I have modified the Client object in Config.cs of the IdentityServerWithAspNetIdentity
            // OpenID Connect hybrid flow and client credentials client (MVC)
            new Client
            {
                ClientId = "mvc",
                ClientName = "MVC Client",
                AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,

                RequireConsent = false,

                ClientSecrets = 
                {
                    new Secret("LynxJournal".Sha256())
                },

                //RedirectUris = { "http://localhost:5002/signin-oidc" },
                //PostLogoutRedirectUris = { "http://localhost:5002" },
                RedirectUris = { serverConfig["MvcClientUrl"]  + "/signin-oidc" },
                PostLogoutRedirectUris = { serverConfig["MvcClientUrl"] },

                IdentityTokenLifetime = 3600,
                AccessTokenLifetime = 3600,
                AuthorizationCodeLifetime = 3600,

                AllowedScopes =
                {
                    StandardScopes.OpenId.Name,
                    StandardScopes.Profile.Name,
                    StandardScopes.OfflineAccess.Name,
                    "api1"
                }
            }

This extends the life of the token to one hour where before the defaults seemed to give about 15-20 minutes. I added values for IdentityTokenLifetime, AccessTokenLifetime and AuthorizationCodeLifetime

A:

Token lifetimes are set per client application. This includes both identity and access tokens. See client application entity.
If you are talking about session length this is set by each application upon successful authentication using IdentityServer.

