Anyway to check/manage existing tokens?

[DawenXie]

For an admin, do we have a way to check/manage existing tokens?

[RichardWatson · Accepted solution]

I don't think that there is any way to get a list of tokens which have been generated/issued.

You can however, change the security key which will invalidate tokens previously issued.  You can also control how long tokens can be issued for as well.

Do you have a specific concern/problem?

[DawenXie]

Thanks for your answer.

We are using long-lived tokens for our applications. We need to generate new tokens before they are expired and we don't give end user access directly, i.e., the applications use the tokens via a server site proxy page. It would be very helpful to have interface for admin to get the a list of tokens and their expiration dates.

I don't think that there is any way to get a list of tokens which have been generated/issued.

You can however, change the security key which will invalidate tokens previously issued.  You can also control how long tokens can be issued for as well.

Do you have a specific concern/problem?

[RichardWatson]

If you generate the tokens then you can manage this information yourself.

I do not believe that ArcGIS Server is going to do this for you.

[DawenXie]

I agree with the first part -- yes, we should manage it with documentation.

But for the second part, I was wondering why not. ArcGIS has provided admin access to different information, e.g., for the security part, we have access to manage users, roles, tokens (configuation), etc. I think having access to all tokens would be useful. Anyway, just my 2 cents.

If you generate the tokens then you can manage this information yourself.

I do not believe that ArcGIS Server is going to do this for you.

[nicogis]

you can post in ESRI ArcGIS Ideas http://ideas.arcgis.com/

[DawenXie]

Thanks for your suggestion. I added one:
https://c.na9.visual.force.com/apex/ideaView?id=087E00000004VcsIAE

Kindly support it if you think it's useful as well.

you can post in ESRI ArcGIS Ideas http://ideas.arcgis.com/

[MattLane]

It was my understanding that tokens aren't generated and then stored anywhere by AGS, but rather just an encrypted string that contains the credentials and expiration, with encryption generated with the security key. Therefore AGS doesn't know what was generated in the past, but looks at a token as it comes in and decrypts it to make sure it is valid before it processes the request.