TIMEOUT Issue

 Status Update:

Investigation into the recurring "Unauthorized" pop-up identified a probable cause in the Grafana configuration. The grafana.ini [auth] section contains:

login_maximum_lifetime_duration = 1m

In Grafana, a lowercase m means minutes, not months. This caps the maximum session lifetime at one minute, which matches the reported 30-second to 2-minute cycle of the "Unauthorized" pop-up and forced refresh. The Grafana default for this setting is 30d.

A secondary contributing factor is under review: whether Grafana is configured to use the Keycloak refresh token (use_refresh_token). Without it, Grafana cannot silently renew an expired access token, so the browser receives a 401 when Keycloak's access token lifespan elapses. Keycloak's default access token lifespan is 5 minutes, which could produce the same symptom at a different interval.

While troubleshooting this ticket, a separate and more severe defect was found: SSO users other than the first cannot be created in Grafana at all, due to duplicate email addresses inherited from the GTAC LDAP provider. That has been raised as its own bug and has a MOP prepared. The two issues are independent, but both touch the [auth.generic_oauth] configuration, so the fixes should be sequenced rather than applied in parallel.

No configuration changes have been made yet. All findings to date are from log review and config inspection.

Next Steps:

1. Confirm whether login_maximum_lifetime_duration = 1m was set intentionally (for example as a security requirement) or is a units mistake. — Owner: [name]
2. Capture Keycloak's Access Token Lifespan, SSO Session Idle, and SSO Session Max values from the realm's Sessions and Tokens settings, for comparison against the observed interval.
3. Verify NTP sync between the Grafana and Keycloak hosts. Clock drift causes tokens to be treated as expired on arrival and produces intermittent 401s.
4. Reproduce with browser developer tools open and capture the failing request, its 401 response, and the timestamp, to confirm which token is expiring.
5. In test, correct login_maximum_lifetime_duration to 30d (or the approved value), restart Grafana, and monitor for a minimum of 30 minutes of idle and active use.
6. If the pop-up persists, enable use_refresh_token = true and confirm Keycloak is issuing refresh tokens to the grafana client.
7. Sequence against the user sync bug: apply that fix first in test, since it rewrites the same config section, then re-validate this issue.