The defaults are sensible. Change them only with a reason.
How long things last
- Access — 1 hour.
- Identity assertion — 5 minutes.
- Sign-in code — 60 seconds.
- Stay-signed-in, idle — 30 days; absolute — 90 days.
- Device code — 10 minutes.
- Consent — 1 year, or never if set to zero.
All can be set per application. If you lengthen the access lifetime, understand that you are lengthening the period in which stolen access remains usable.
Signing keys rotate automatically
ActiveManage signs its identity assertions with a key that rotates every 90 days by default. A retired key stays published until everything signed with it has expired, so rotation never breaks anything in flight.
Tell developers to fetch your signing keys from the address ActiveManage publishes them at, rather than copying a key into their configuration. An application with a key hard-coded will break at the first rotation — usually three months after it was built, which is a difficult problem to diagnose.
Four ways access is withdrawn
- The user disconnects the application from their account page. This is the route to point users at.
- The application signs the user out and gives up its access.
- You disable the application. It can obtain nothing new, though access it already holds remains usable until it expires.
- Theft is detected and the chain is cancelled automatically.
If an application is compromised
Disable it, revoke its consents, and rotate its secret — in that order. Have this written down before you need it.