User access token expiration

[coffee-squirrel]

What?

It should be possible for access tokens to have an expiration date enforced, with the lifespan option(s) defined by Graylog administrators ("never expire" being one possible value).

Additionally, users should be notified in the UI when their access tokens are nearing expiration.

Why?

Organizations may have a requirement to rotate credentials periodically. Currently, access token rotation is dependent upon the user deciding to take action.

Your Environment

• Graylog Version: 6.1.4

[tellistone]

Captured in the Token management and default TTL pitch