Dynamically modify Session Lifespan and update existing sessions.

[arieltorti]

Hey !

We're running the self-hosted version of the Ory Kratos and we need the flexibility of modifying session lifespans. Is there a way to do this programmatically through an API similar to what's provided when using Ory Network?

Currently, the only option is to edit the schema files and restart the instances so the changes in the schemas take effect.

Moreover, would it be possible to bulk-update or bulk-expire user sessions when the lifespan is modified? After a few tests, I noticed that when the session lifespan is changed and the instances are restarted existing sessions are still active and under the effect of the old lifespan.

[aeneasr]

Is there a way to do this programmatically through an API similar to what's provided when using Ory Network?

The functionality in the Ory Network is the same as in self-hosted for this feature. What you're probably looking for is: https://www.ory.sh/docs/kratos/session-management/refresh-extend-sessions

Moreover, would it be possible to bulk-update or bulk-expire user sessions when the lifespan is modified? After a few tests, I noticed that when the session lifespan is changed and the instances are restarted existing sessions are still active and under the effect of the old lifespan.

I don't think we can add that - updating 100M+ rows on a config change can bring a system down :)

[arieltorti]

The functionality in the Ory Network is the same as in self-hosted for this feature. What you're probably looking for is: https://www.ory.sh/docs/kratos/session-management/refresh-extend-sessions

That's similar but it's not what I'm looking for. I want to modify the session lifetime via an API, so that when I change it, for example, from 30 days -> 7 days newly created sessions expire in 7 days instead of 30.

In order to do that now I have to change Kratos config file and restart the service, I'm trying to avoid that because I need to change this programmatically.

I don't think we can add that - updating 100M+ rows on a config change can bring a system down :)

Makes total sense.

[aeneasr]

The configuration file is hotreloaded, so you don't need to restart the service. API based configuration is out of scope for self-hosted

[arieltorti]

One last detail, is there an endpoint to retrieve the current config with defaults applied? Similar to what was asked here: #3027

Basically, a read-only config API.

[vinckr]

No API when you are self-hosting, but since you have full control over that you probably can implement something that fits your use case.
Would that also be for dynamically modifying session lifespans?

[arieltorti]

Exactly, if I modify the file Ory will hot-reload it but I want to be able to verify and query the new configuration. I can work around it but it would be helpful if Kratos provided a read config endpoint.

[arieltorti]

The read config endpoint is also useful for cases where values are overridden by environment variables.

[geekodour]

I've noticed that if I restart kratos, all user sessions are logged out and they need to re-log in. is this expected?