# Access Token Timeout Issue **URL:** \ **Category:** OAuth/OIDC\ **Created:** [May 6, 2023, 5:38pm UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176 "2023-05-06T17:38:37Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![gary\_r](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gary\_r](https://devforum.okta.com/u/gary_r)\ **Post date:** [May 6, 2023, 5:38pm UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/1 "2023-05-06T17:38:38Z")
Hi, I’m experimenting with Okta as an authentication provider for Kubernetes. In Terraform, I set the Access Token timeouts as follows: access\_token\_lifetime\_minutes = 6 refresh\_token\_lifetime\_minutes = 10 refresh\_token\_window\_minutes = 7 I expected that when a user logs in and is inactive for at most 10 minutes and then tries again to execute a Kubernetes query, he/she should be redirected to the Okta log-in page. But that is not what’s happening, if the user is inactive for 2 hours or more, only then are they redirected to the log-in page. Am I missing something here? Below is the rule and a screenshot of Okta admin page that shows the values are correctly set. Thanks! resource “okta\_auth\_server\_policy\_rule” “auth\_policy\_rule” { name = “AuthCode + PKCE” auth\_server\_id = okta\_auth\_server.oidc\_auth\_server.id policy\_id = okta\_auth\_server\_policy.auth\_policy.id priority = 1 grant\_type\_whitelist = [ “authorization\_code” ] scope\_whitelist = [“\*”] group\_whitelist = [“EVERYONE”] access\_token\_lifetime\_minutes = 6 refresh\_token\_lifetime\_minutes = 10 refresh\_token\_window\_minutes = 7 } ![image](https://global.discourse-cdn.com/oktadev/original/2X/6/65c7e8351da9e5a3f55b2af9acdb4aeb7ae3092f.png) ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [May 6, 2023, 10:54pm UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/2 "2023-05-06T22:54:47Z")
1. Are you sure that your UI application does not silently refresh access\_token with Okta during those 2 hours? 2. You can check what is a user global session policy which establishes Okta session max lifetime ---
**Author:** ![gary\_r](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gary\_r](https://devforum.okta.com/u/gary_r)\ **Post date:** [May 7, 2023, 12:50am UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/3 "2023-05-07T00:50:51Z")
Hi, and thanks for your response. The cline is Kubernetes kubectl (command line), it exhibits the same behavior even if the terminal is restarted so I doubt the client is sending token refresh requests. I’m not familiar with the global session policy you mentioned, how do we check that? Thanks! ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [May 7, 2023, 1:08am UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/4 "2023-05-07T01:08:19Z")
I see the grant is authz code with PKCE. Is it really how kubectl obtains this token? Or is there any proxy/provider doing OAuth dance with Okta? ---
**Author:** ![gary\_r](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gary\_r](https://devforum.okta.com/u/gary_r)\ **Post date:** [May 7, 2023, 1:36am UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/5 "2023-05-07T01:36:18Z")
It uses a plugin called kubelogin that manages OIDC communications on behalf of Kubernetes: [kubelogin/usage.md at master · int128/kubelogin (github.com)](https://github.com/int128/kubelogin/blob/master/docs/usage.md) The only connection time-related setting it uses is called " ``` –authentication-timeout-sec ```auto which really deals with the amount of time needed to connect to the OIDC through the browser, as the doc says it is 3 minutes. Thanks. ``` ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [May 7, 2023, 12:14pm UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/6 "2023-05-07T12:14:48Z")
Gotcha. Always good to learn something new. To be honest, I’d try to grab the access\_token returned by Okta (if it’s visible in the console) and inspect it to see the expiration time (does it match your policy configured). If it does - then maybe something wrong is with the plugin. If it does not match - then dig inside Okta. Maybe you checking a wrong policy? ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [May 7, 2023, 3:23pm UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/7 "2023-05-07T15:23:41Z")
Check this [article](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/) ---
**Author:** ![gary\_r](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@gary\_r](https://devforum.okta.com/u/gary_r)\ **Post date:** [May 8, 2023, 12:20am UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/8 "2023-05-08T00:20:44Z")
Thanks very much, I’l check it out. Thanks again for your help! ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 14, 2024, 5:01pm UTC](https://devforum.okta.com/t/access-token-timeout-issue/24176/9 "2024-02-14T17:01:04Z")
Closed on February 14, 2024, 5:01pm UTC