How to set the Oak login token session expiration

Go to http://aem-host:port/system/console/configMgr/org.apache.jackrabbit.oak.security.authentication.token.TokenConfigurationImpl and log in as admin

Edit the value of the token configuration:

• Token Expiration=Set this to desired timeout value in milliseconds (for example 3600000 would be 1 hour)
• Token Length=8
• Hash Iterations=1000
• Hash Salt Size=8
  

Once you edit the TokenConfiguration from the OSGI console, the file /apps/system/config/org.apache.jackrabbit.oak.security.authentication.token.TokenConfigurationImpl.config is created in the JCR repository.

Go to http://aem-host:port/crx/de/index.jsp

Browse to and open this file /apps/system/config/org.apache.jackrabbit.oak.security.authentication.token.TokenConfigurationImpl.config

If the field passwordHashAlgorithm exists in the file, then remove that line and save.  For example, now your file might look like this:

^{passwordHashIterations=I"1000"
tokenExpiration="3600000"
tokenLength="8"
passwordSaltSize=I"8"}

For more documentation on the token configuration, see the api docs.