Join the conversation

Sign in to join this conversation, and others like it, in the communities you care about.

Wekan

General

Wekan is an open-source kanban board (Trello like) which allows a card-based task and to-do management.

More active conversations

Wekan / General

login, tokens and expiration

login, tokens and expiration

Wekan/General · April 14, 2020 at 5:01pm

Paul Verdone

@pvcon13
rep
1.5k

login, tokens and expiration

Wekan / General · April 14, 2020 at 5:01pm

Once you have registered and then logged in with Password you get a token with a token expiration date.

If you do not logout ,that token and its expiration determines how long you can go to the site before you have to re-authenticate, correct?

If you logout, is that token still good for the duration of the original expiration date or are you re-issued a new token with a further in future expiration date?

Where can I change that expiration to a longer or short time? (in the api) or (in the GUI) or (in mongo collection)

Can I remove the expiration time so it never times out? (in the api) or (in the GUI) or (in mongo collection)

Can I force the token to expire prematurely with no user activity for a while (like 4 hours)? (in the api) or (in the GUI) or (in mongo collection)

I have an application where for some features for some users are already logged into another application and for many accounts they all see wekan as a web page embed, so getting another challenge/response to auth into wekan is a limitation. Call it a trust relationship between the two apps. The mother app has a very high authentication hurtle (three keys and two factor). Trting to automate or at least streamline the auth back into wekan.

Thanks as always

Load previous messages
April 15, 2020 at 3:21pm
Paul Verdone@pvcon13
3:21pm

like with no activity or if we have too many tokens floating around we no longer need as they have been replaced in effect by newer ones

    • reply
    • like
    3:21pm

    so I would set that (where I have to to zero and then run my own method to police in the mean time

      • reply
      • like
      3:38pm

      I looked online for wekan loginExpirationIndays did not find anything useful

        • reply
        • like
        3:38pm

        can I assume that is settable in snap?

          • reply
          • like
          3:38pm

          thanks

            • reply
            • like
            April 15, 2020 at 10:23pm
            Lauri Ojansivu@xet7
            Team
            10:23pm

            I think those tokens are at mongodb database, but there is no snap setting for that

              • reply
              • like
              Paul Verdone@pvcon13
              10:27pm

              the tokens are in mongo under the header resume yes

                • reply
                • like
                10:28pm

                the loginexpireindays variable I cannot find anywhere in Mongo

                  • reply
                  • like
                  10:28pm

                  unless if it not set (declared) then there is a coded default

                    • reply
                    • like
                    10:29pm

                    what the link you posted above ...the line I am speaking of is:

                      Edited
                      • reply
                      • like
                      10:29pm

                      Ok i did some research, the login tokens are stored under resume.loginTokens and you can config the expiration with a setting loginExpirationInDays where null or 0 means, never delete tokens.

                        Edited
                        • reply
                        • like
                        10:30pm

                        does config mean at the snap level?

                          • reply
                          • like
                          April 16, 2020 at 3:31am
                          Lauri Ojansivu@xet7
                          Team
                          3:31am

                          snap commands are environment variables passed to node.js. Those may or may not effect database in some way. It's like sudo snap set root-url='https://example.com'. You see all commands with wekan.help | less

                            • reply
                            • like
                            3:31am

                            at bash, it's export ROOT_URL=https://example.com

                              • reply
                              • like
                              3:32am

                              similarly at docker-compose.yml at https://wekan.github.io

                                • reply
                                • like
                                April 16, 2020 at 5:37pm
                                Paul Verdone@pvcon13
                                5:37pm

                                yes, I looked at wekan.help and did not see that in the listing for snap commandlines

                                  • reply
                                  • like
                                  5:38pm

                                  so I guess I have to try and add that to each user in mongo directly and see what happens

                                    • reply
                                    • like