Time-bound access
Access for the length of the job, not until someone remembers to take it back.
- Expires
- Shares · approved requests · group memberships
- Length
- 5 minutes to 1 year
- Renewals
- 3, one hour each (default)
- Where
- My Access › Expiring
Access a contractor needs for a week, or an analyst needs for one investigation, should end when the job does. A time-bound grant has a cutoff; at the cutoff it ends without anyone acting.
What can expire
| Grant | Where you set the expiry |
|---|---|
| A share | Expires at in the Share dialog |
| An approved access request | Expiry when approving |
| A group membership | Expires at when adding the member on the group's page |
| A break-glass elevation | Its duration, chosen when breaking the glass |
The expiry is between five minutes and one year from now. To give a person a role for a limited time, add them to a group that holds the role with a membership that expires. Role assignments and denies can also carry an expiry through the API.
Setting an expiry needs Advanced Access Control.
Before the cutoff
Thirty minutes before a grant ends, the person holding it is notified: Access expiring, with the time it lapses and whom to ask to renew it. The grant also shows on their My Access → Expiring tab, soonest first.
What expires, when, and whether you may renew it
What happens at the cutoff
A share stops granting access at its cutoff. A group membership, a role or a break-glass elevation is removed by the expiry sweep, which runs every five minutes, so it can last up to five minutes past the cutoff. Either way the holder is notified (Access expired) and the event is recorded as grant.expired.
The sweep runs on every licence. A grant that was given with an expiry ends on schedule even after a downgrade.
Renew a grant
Renewing is a fresh decision to give the access, so only someone who could grant it now may renew it:
| Grant | Who may renew it |
|---|---|
| A share or an approved request | Someone holding share on the resource, who also holds the shared verb |
| A group membership | Someone who may add members to the group, and holds what the group gives |
| A role | Someone who may assign the role |
The person holding the grant does not extend it themselves, and someone who granted it but has since lost that right does not either. Ask the owner, the steward or an administrator; the Expiring tab shows grants you gave as well as grants you hold, so they can renew from there.
Renew sets the expiry to one hour from now. It is offered when the grant has less than that left; earlier, renewing would shorten the grant. A grant can be renewed three times; after that, grant it again. A break-glass elevation and a deny are never renewed.
On the Expiring tab, a grant you may not renew says why, in this order: the licence does not include renewals; it is a break-glass elevation; you may not renew it (and whom to ask); the renewal limit is reached; it is too early to renew. Each renewal is recorded as grant.renewed with the old and new expiry.
Settings
| Setting | Default | Meaning |
|---|---|---|
modules.authz.expiryWorker.schedule | 0 */5 * * * * | When the sweep runs (cron with seconds). Empty turns the sweep and the warnings off. |
modules.authz.expiryWorker.warnBeforeMinutes | 30 | How long before the cutoff the holder is warned. A negative value turns the warning off. |
modules.authz.expiryWorker.maxRenewals | 3 | Renewals per grant. A negative value allows none. |
modules.authz.expiryWorker.renewalExtensionMinutes | 60 | How far from now a renewal sets the expiry. |
Set them in config.yaml or as environment variables, for example MAESTROHUB_MODULES_AUTHZ_EXPIRYWORKER_MAXRENEWALS=5. See Configuration.
Without the licence
Grants that already have an expiry still end on schedule, and still show on the Expiring tab. Giving a new time-bound grant and renewing one need Advanced Access Control; Renew is disabled with the reason. See Licence changes.