Thanks Jeff.
Sorry it's been some time since I looked at this but I'm ust looking into integration with OpenAM as an SSO solution and authentication is on my radar again.
I'm not sure that your response "it's always been like that" is a sufficient answer.
If tickets never expire then how do they get cleaned up in the database ? or have I finally found the reason why our Alfresco prod database is now 17Gig in size?
I would expect this behavior from something like OAuth tokens, but in this case I would save these for later and only attempt to generate new ones if I get an authentication error using an existing one.
For Alfresco tokens, the context is more closely related to say SSO tokens and often have life cycles similar too or controlled by sessions, in fact that's the basis of our current use of Alfresco tokens - whether this is correct or not is open to debate.
So, given that they don't expire…. what would be your suggestion for a usage pattern? i.e. how can I ensure I do not continually create new tokens.
Regards
Steve
