No support of token refresh for encapsulated tokens

Description

Environment

• AEM 6.x.x
• AEM as a cloud service

Issues/Symptoms
There’s no support for token refresh for encapsulated tokens.

Resolution

An encapsulated token is a self-contained token which has a fixed expiration time depending on what is set in the OSGI TokenConfiguration as in (Figure 1).
If the encapsulated token is enabled as shown in (Figure 2), the login session will expire after token Expiration time has run out - even if a token refresh has been enabled as shown in (Figure 1).

For example: if token expiration set is 360000ms as in (Figure 1), the session will expire in 1 hour, the user will have to re-login after 1 hour.

To learn more about encapsulated tokens, see Encapsulated Token Support in our AEM Administering Guide.

The following Token Refresh flag on Oak TokenConfiguration (Figure 1) works fine with sticky sessions.
If you have enabled encapsulated tokens as in (Figure 2), you will have to make sure you have enough expiration time set, because token refresh is not supported with encapsulated tokens.

(Figure 1) Apache Jackrabbit Oak TokenConfiguration

(Figure 2) Token Authentication Handler - Encapsulated token

Business.Adobe.com resources