Make experimental for mas configurable

[suse-coder]

Is your feature request related to a problem? Please describe.
I would like to set these by myself. Currently they are hard coded into the helm chart.

[experimental](https://element-hq.github.io/matrix-authentication-service/reference/configuration.html#experimental)
Settings that may change or be removed in future versions. Some of which are in this section because they don't have a stable place in the configuration yet.

experimental:
  # Time-to-live of OAuth 2.0 access tokens in seconds. Defaults to 300, 5 minutes.
  #access_token_ttl: 300

  # Time-to-live of compatibility access tokens in seconds, when refresh tokens are supported. Defaults to 300, 5 minutes.
  #compat_token_ttl: 300

  # Experimental feature to automatically expire inactive sessions
  # Disabled by default
  #inactive_session_expiration:
     # Time after which an inactive session is automatically finished in seconds
     #ttl: 32400

     # Should compatibility sessions expire after inactivity. Defaults to true.
     #expire_compat_sessions: true

     # Should OAuth 2.0 sessions expire after inactivity. Defaults to true.
     #expire_oauth_sessions: true

     # Should user sessions expire after inactivity. Defaults to true.
     #expire_user_sessions: true

[suse-coder]

This is what i have in the helm chart under additional for mas:

upstream_oauth2:
      providers:
        - id: "01H8Psdfsdf4YGH1RWV279"
          issuer: "https://test.de/realms/test-services"
          token_endpoint_auth_method: client_secret_basic
          client_id: "https://mas.test.de"
          client_secret: "liKtsdfsdddfNUFLcE10MrJLr4d"
          scope: "openid profile email profile"
          label: "Continue with test.de/realms/-services"
          button_text: "Continue with test.de/realms/-services"
          claims_imports:
            localpart:
              action: require
              template: "{{ user.preferred_username }}"
            displayname:
              action: suggest
              template: "{{ user.name }}"
            email:
              action: suggest
              template: "{{ user.email }}"
              set_email_verification: always
experimental:
      access_token_ttl: 300000
      compat_token_ttl: 300000
      inactive_session_expiration:
        ttl: 32400
        expire_compat_sessions: true
        expire_oauth_sessions: true
        expire_user_sessions: true

it is rendered into the secret but only the oauth2 works, the experimental seems to be not applied as it still has the old value. My guess is as it is hard coded it will override it from what I added.

[benbz]

I don't see this behaviour. I only see experimental.access_token_ttl not being overridable. e.g. with the following additional values file:

matrixAuthenticationService:
  extraEnv:
  - name: "DEBUG_RENDERING"
    value: "1"
  additional:
    test.yaml:
      config: | 
        experimental:
          access_token_ttl: 300000
          compat_token_ttl: 300000
          inactive_session_expiration:
            ttl: 32400
            expire_compat_sessions: true
            expire_oauth_sessions: true
            expire_user_sessions: true

I get the following:

$ kubectl -n ess logs -c render-config ess-matrix-authentication-service-d77f48468-7p6np
Rendering config to file: /conf/config.yaml
...
experimental:
    access_token_ttl: 86400
    compat_token_ttl: 300000
    inactive_session_expiration:
        expire_compat_sessions: true
        expire_oauth_sessions: true
        expire_user_sessions: true
        ttl: 32400
...

experimental.access_token_ttl is not overrideable as we treat https://github.com/element-hq/ess-helm/blob/main/charts/matrix-stack/configs/matrix-authentication-service/config.yaml.tpl as an override file and not an underride file. I think the experimental and policy blocks are the only ones we'd be happy splitting into an underride file

[suse-coder]

Yes I agree. Its only access_token_ttl that cant be changed. I would like to make access_token_ttl higher for testing as some users get randomly "token is not active" after a day, but not all user (we use keycloak sso).

[suse-coder]

@benbz can you make it that access_token_ttl can be overriden?