Add a time interval option in the JIT access request UI

[dneduva-cisco]

As an enhancement, we would like the option to request the amount of time a user is given access to a certain role in JIT as part of the request.
We would like that to be an option in the JIT UI instead of an environment variable in the app.yaml.

[jpassing]

I agree that this would be a useful feature. The ACTIVATION_TIMEOUT (in app.yaml) would then define an upper bound (for ex, 2h). Users could choose to activate a role for a shorter period of time (for ex, only 30min), but couldn't go beyond that upper bound.

[lnrdll]

+1

[jpassing]

This feature is now available in release 1.4: You can now choose the duration for which to activate a role, between 5 minutes and the maximum duration specified by ACTIVATION_TIMEOUT.

[lnrdll]

Could we log the duration for which the user has requested elevation?

[jpassing]

The logs contain the start and end date in the activation_start and activation_end labels:

This (implicitly) gives you the duration. We could add an extra label for duration, but I guess it would be somewhat redundant?

[lnrdll]

I think I overlooked these entries. No need for an extra label. Thanks!