JWT Not Respecting Session Lifetime Configured in the Okta Sign On Policy
Last Updated:
Overview
The JSON Web Token (JWT) expires after 60 minutes, even though the Sign On Policy has a Session Lifetime of a different value (for example, 120 minutes).
Applies To
- OpenID Connect (OIDC)/OAuth
- JSON Web Token (JWT)
- Okta Classic Engine
- Okta Identity Engine (OIE)
Cause
The JWT validity/lifetime is independent of the Session Lifetime defined in any of the Okta Sign-On Policies. To change the JWT validity/lifetime, it must be modified in the Authorization Server configuration, which requires the API Access Management feature. Default values for JWT can be found in the Token lifetime article.
Solution
To modify the JWT validity/lifetime, the access policy/rule must be modified in the Authorization Server settings. To do this, navigate to the Okta Admin Console > Security > API > Authorization Server > Access Policy > Rule.
More details on how to modify Access Policies and Rules can be found in Create access policies documentation.
