We have a system in which external users can be invited to our identity management system. The users are not employees of our company, but of our customers. The administrators of the customer do not have access to the system the users are invited to.
Currently we send invite emails to the users email addresses that contain links that are valid for 7 days. The problem is that not all users can or want to respond to that mail within the 7 days - for example because they are on holiday.
This leads to manual "re-issuing" invite mails to users which is a lot of work. It is done by our employees, because the customer administrators do not have access to the system - as mentioned above. We'd like to minimize this manual intervention but we're not sure if the measures we proposed are a good idea from a security perspective. I specifically ask about user invites, because in this case the user does not initiate the invite themselves, and have no control over when the invite happens. Can you please help us out?
- Should user invite links expire at all - if so, what would be a good expire time?
- Would it be a good idea to let users "extend" their invite if they click on it after it has already expired - for example by sending another email with a new invite link?