Reduce role token expiry to 10 minutes

2 files changed, 28 insertions, 5 deletions

diff --git a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/client/zts/ZtsClient.java b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/client/zts/ZtsClient.java
index e52abc4193b..30c8ab2fd50 100644
--- a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/client/zts/ZtsClient.java
+++ b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/client/zts/ZtsClient.java
@@ -68,15 +68,37 @@ public interface ZtsClient extends AutoCloseable {
      * @param domain Target domain
      * @return A role token
      */
-    ZToken getRoleToken(AthenzDomain domain);
+    default ZToken getRoleToken(AthenzDomain domain) {
+        return getRoleToken(domain, Duration.ofHours(1));
+    }
+
+    /**
+     * Fetch a role token for the target domain
+     *
+     * @param domain Target domain
+     * @param tokenExpiry Token expiry
+     * @return A role token
+     */
+    ZToken getRoleToken(AthenzDomain domain, Duration tokenExpiry);
+
+    /**
+     * Fetch a role token for the target role
+     *
+     * @param athenzRole Target role
+     * @return A role token
+     */
+    default ZToken getRoleToken(AthenzRole athenzRole) {
+        return getRoleToken(athenzRole, Duration.ofHours(1));
+    }
 
     /**
      * Fetch a role token for the target role
      *
      * @param athenzRole Target role
+     * @param tokenExpiry Token expiry
      * @return A role token
      */
-    ZToken getRoleToken(AthenzRole athenzRole);
+    ZToken getRoleToken(AthenzRole athenzRole, Duration tokenExpiry);
 
     /**
      * Fetch an access token for the target domain
diff --git a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java
index 1523537d84c..ac211779fad 100644
--- a/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java
+++ b/vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java
@@ -68,7 +68,8 @@ public final class AthenzIdentityProviderImpl extends AbstractComponent implemen
     static final Duration UPDATE_PERIOD = Duration.ofDays(1);
     static final Duration AWAIT_TERMINTATION_TIMEOUT = Duration.ofSeconds(90);
     private final static Duration ROLE_SSL_CONTEXT_EXPIRY = Duration.ofHours(2);
-    private final static Duration ROLE_TOKEN_EXPIRY = Duration.ofMinutes(30);
+    // TODO CMS expects 10min or less token ttl. Use 10min default until we have configurable expiry
+    private final static Duration ROLE_TOKEN_EXPIRY = Duration.ofMinutes(10);
 
     // TODO Make path to trust store paths config
     private static final Path CLIENT_TRUST_STORE = Paths.get("/opt/yahoo/share/ssl/certs/yahoo_certificate_bundle.pem");
@@ -321,13 +322,13 @@ public final class AthenzIdentityProviderImpl extends AbstractComponent implemen
 
     private ZToken createRoleToken(AthenzRole athenzRole) {
         try (ZtsClient client = createZtsClient()) {
-            return client.getRoleToken(athenzRole);
+            return client.getRoleToken(athenzRole, ROLE_TOKEN_EXPIRY);
         }
     }
 
     private ZToken createRoleToken(AthenzDomain domain) {
         try (ZtsClient client = createZtsClient()) {
-            return client.getRoleToken(domain);
+            return client.getRoleToken(domain, ROLE_TOKEN_EXPIRY);
         }
     }