Composite-identity OAuth token TTL is shorter than the DAP workload timeout

Duo Agent Platform workload git operations authenticate with the composite-identity OAuth token, whose TTL is 1 hour, while the workload job timeout is 2 hours. A workflow that runs longer than the token's life loses git access part-way through.

Why this is not specific to the credential helper

This surfaced while reviewing gitlab!243872, which replaces the sed-based token-in-URL git auth with a credential helper. It is not introduced by that change:

  • token_variables in Ai::DuoWorkflows::StartWorkflowService sets GIT_PASSWORD to @params[:workflow_oauth_token] unconditionally, on both the flag-on and flag-off paths.
  • The pre-existing sed path already authenticates the agent's ongoing git operations (run_command, run_git_command) with that same token, in production, today.

So the exposure is the same before and after that MR, and its rollout percentage does not change it. It was de-scoped from the rollout preconditions in gitlab#612645 with AppSec agreement ("Agreed on the TTL reasoning and fine to de-scope that as it's not a blocker for AppSec").

Failure mode

Roughly an hour into a long-running workflow, git operations begin failing. Because the token is supplied per-invocation, this looks like an intermittent mid-job git auth failure rather than a clean startup error, and only on workflows that run long enough — which makes it awkward to attribute.

Workflows paused for human input are the most likely to hit it, since wall-clock time accrues while the flow waits.

Options

  1. Refresh the token for the credential helper / GIT_PASSWORD during the job. Most complete; needs a refresh path into a running workload.
  2. Lower the workload timeout to fit inside the token TTL. Cheapest, at the cost of capping long workflows.
  3. Issue a job-lifetime git credential distinct from the composite identity token, accepting the different identity semantics.

Worth noting AppSec's preference if a refresh mechanism lands: keep the TTL short rather than raising it.

Related