Token expired or invalidated before end of TTL

Vault
1

Forgive me as I am still very new to admining vault.
But I setup a service account and minted a token against that service account using the following commands

export VAULT_ADDR= 'https://VAULT-SERVER.FQDN.ORG:8200'
vault login -method=ldap username=SERVICEACCOUNTNAME
vault token create -policy=my_policy -explicit-max-ttl=8761h -ttl=8760h -display-name=MY_SERVICE_TOKEN

My token is then minted without issue and shows something like this
“creation_ttl 8760h”
“explicit_max_ttl 8761h”

Any idea why the token dies? I find it very hard to determine this information based on the logs etc.

Thanks so much for any help that can be provided?

2

Anybody? I could seriously use some advice here as the token just died again. :frowning:

3

How long does the token created when you login last? If the login token expires, so will any other tokens that it created. To prevent that look at the -orphan option: token create - Command | Vault by HashiCorp

4

@stuart-c The tokens are lasting exactly 30 days.
From what I could derive, my comment here

vault token create -policy=my_policy -explicit-max-ttl=8761h -ttl=8760h -display-name=MY_SERVICE_TOKEN

Should mint a token for 1 year exactly, the created token does say it’s TTL is 8760h so not sure why at the 30 day mark it dies?