2.2.4 Created admin token has no access

[krukas]

When you create a token for an admin user and have set the options (Admin Token Lifetime (hours)) to empty, you will get an access denied because the token immediately expires.

Preconditions

1. Set the option Admin Token Lifetime (hours)) to empty.

Steps to reproduce

1. Create admin token with /V1/integration/admin/token
2. Do any other call with this token

Expected result

1. get result back for given API call

Actual result

1. Consumer is not authorized to access %resources

For keeping the empty feature that is wont expire, we need to add a check for the token TTL: https://github.com/magento/magento2/blob/2.2-develop/app/code/Magento/Webapi/Model/Authorization/TokenUserContext.php#L135

If I have some time I will create a pull request for this.

[magento-engcom-team]

Hi @krukas. Thank you for your report.
The issue has been fixed in #15598 by @krukas in 2.2-develop branch
Related commit(s):

• eab367461cefb99faa2fe40089c179ee924e2e3b
• 3ca1c6fdb83b6078ce16e20452a6765b8eac2d32

The fix will be available with the upcoming 2.2.6 release.

[magento-engcom-team]

Hi @krukas. Thank you for your report.
The issue has been fixed in #15744 by @vijay-wagento in 2.3-develop branch
Related commit(s):

• 7f34b221d692f9bda0b3d6c9d17c76bd65cad30a
• 349d178ee84de6b458d8783c16cf30bb25d51dc5

The fix will be available with the upcoming 2.3.0 release.