diff --git a/lib/puppet/type/keycloak_realm.rb b/lib/puppet/type/keycloak_realm.rb
index fed8ab2..7739216 100644
--- a/lib/puppet/type/keycloak_realm.rb
+++ b/lib/puppet/type/keycloak_realm.rb
@@ -1,185 +1,189 @@
 require_relative '../../puppet_x/keycloak/type'
 require_relative '../../puppet_x/keycloak/array_property'
 require_relative '../../puppet_x/keycloak/integer_property'
 
 Puppet::Type.newtype(:keycloak_realm) do
   desc <<-DESC
 Manage Keycloak realms
 @example Add a realm with a custom theme
   keycloak_realm { 'test':
     ensure                   => 'present',
     remember_me              => true,
     login_with_email_allowed => false,
     login_theme              => 'my_theme',
   }
   DESC
 
   extend PuppetX::Keycloak::Type
   add_autorequires(false)
 
   ensurable
 
   newparam(:name, namevar: true) do
     desc 'The realm name'
   end
 
   newparam(:id) do
     desc 'Id. Default to `name`.'
     defaultto do
       @resource[:name]
     end
   end
 
   newproperty(:display_name) do
     desc 'displayName'
   end
 
   newproperty(:display_name_html) do
     desc 'displayNameHtml'
   end
 
   newproperty(:login_theme) do
     desc 'loginTheme'
     defaultto 'keycloak'
   end
 
   newproperty(:account_theme) do
     desc 'accountTheme'
     defaultto 'keycloak'
   end
 
   newproperty(:admin_theme) do
     desc 'adminTheme'
     defaultto 'keycloak'
   end
 
   newproperty(:email_theme) do
     desc 'emailTheme'
     defaultto 'keycloak'
   end
 
   newproperty(:internationalization_enabled, boolean: true) do
     desc 'internationalizationEnabled'
     newvalues(:true, :false)
     defaultto :false
   end
 
   newproperty(:sso_session_idle_timeout, parent: PuppetX::Keycloak::IntegerProperty) do
     desc 'ssoSessionIdleTimeout'
   end
 
   newproperty(:sso_session_max_lifespan, parent: PuppetX::Keycloak::IntegerProperty) do
     desc 'ssoSessionMaxLifespan'
   end
 
   newproperty(:access_code_lifespan, parent: PuppetX::Keycloak::IntegerProperty) do
     desc 'accessCodeLifespan'
   end
 
   newproperty(:access_code_lifespan_user_action, parent: PuppetX::Keycloak::IntegerProperty) do
     desc 'accessCodeLifespanUserAction'
   end
 
+  newproperty(:access_token_lifespan, parent: PuppetX::Keycloak::IntegerProperty) do
+    desc 'accessTokenLifespan'
+  end
+
   newproperty(:access_token_lifespan_for_implicit_flow, parent: PuppetX::Keycloak::IntegerProperty) do
     desc 'accessTokenLifespanForImplicitFlow'
   end
 
   newproperty(:enabled, boolean: true) do
     desc 'enabled'
     newvalues(:true, :false)
     defaultto :true
   end
 
   newproperty(:remember_me, boolean: true) do
     desc 'rememberMe'
     newvalues(:true, :false)
     defaultto :false
   end
 
   newproperty(:login_with_email_allowed, boolean: true) do
     desc 'loginWithEmailAllowed'
     newvalues(:true, :false)
     defaultto :true
   end
 
   newproperty(:browser_flow) do
     desc 'browserFlow'
     defaultto('browser')
     munge { |v| v.to_s }
   end
 
   newproperty(:registration_flow) do
     desc 'registrationFlow'
     defaultto('registration')
     munge { |v| v.to_s }
   end
 
   newproperty(:direct_grant_flow) do
     desc 'directGrantFlow'
     defaultto('direct grant')
     munge { |v| v.to_s }
   end
 
   newproperty(:reset_credentials_flow) do
     desc 'resetCredentialsFlow'
     defaultto('reset credentials')
     munge { |v| v.to_s }
   end
 
   newproperty(:client_authentication_flow) do
     desc 'clientAuthenticationFlow'
     defaultto('clients')
     munge { |v| v.to_s }
   end
 
   newproperty(:docker_authentication_flow) do
     desc 'dockerAuthenticationFlow'
     defaultto('docker auth')
     munge { |v| v.to_s }
   end
 
   newproperty(:default_client_scopes, array_matching: :all, parent: PuppetX::Keycloak::ArrayProperty) do
     desc 'Default Client Scopes'
   end
 
   newproperty(:optional_client_scopes, array_matching: :all, parent: PuppetX::Keycloak::ArrayProperty) do
     desc 'Optional Client Scopes'
   end
 
   newproperty(:supported_locales, array_matching: :all, parent: PuppetX::Keycloak::ArrayProperty) do
     desc 'Supported Locales'
   end
 
   newproperty(:content_security_policy) do
     desc 'contentSecurityPolicy'
     defaultto("frame-src 'self'; frame-ancestors 'self'; object-src 'none';")
     munge { |v| v.to_s }
   end
 
   newproperty(:events_enabled, boolean: true) do
     desc 'eventsEnabled'
     newvalues(:true, :false)
     defaultto :false
   end
 
   newproperty(:events_expiration) do
     desc 'eventsExpiration'
   end
 
   newproperty(:events_listeners, array_matching: :all, parent: PuppetX::Keycloak::ArrayProperty) do
     desc 'eventsListeners'
     defaultto ['jboss-logging']
   end
 
   newproperty(:admin_events_enabled, boolean: true) do
     desc 'adminEventsEnabled'
     newvalues(:true, :false)
     defaultto :false
   end
 
   newproperty(:admin_events_details_enabled, boolean: true) do
     desc 'adminEventsDetailsEnabled'
     newvalues(:true, :false)
     defaultto :false
   end
 end
diff --git a/spec/acceptance/2_realm_spec.rb b/spec/acceptance/2_realm_spec.rb
index e06fd8e..8c2634d 100644
--- a/spec/acceptance/2_realm_spec.rb
+++ b/spec/acceptance/2_realm_spec.rb
@@ -1,140 +1,142 @@
 require 'spec_helper_acceptance'
 
 describe 'keycloak_realm:', if: RSpec.configuration.keycloak_full do
   context 'creates realm' do
     it 'runs successfully' do
       pp = <<-EOS
       include mysql::server
       class { 'keycloak':
         datasource_driver => 'mysql',
       }
       keycloak_realm { 'test':
         ensure => 'present',
       }
       EOS
 
       apply_manifest(pp, catch_failures: true)
       apply_manifest(pp, catch_changes: true)
     end
 
     it 'has created a realm' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get realms/test' do
         data = JSON.parse(stdout)
         expect(data['id']).to eq('test')
       end
     end
 
     it 'has left default-client-scopes' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get realms/test/default-default-client-scopes' do
         data = JSON.parse(stdout)
         names = data.map { |d| d['name'] }.sort
         expect(names).to include('email')
         expect(names).to include('profile')
         expect(names).to include('role_list')
       end
     end
 
     it 'has left optional-client-scopes' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get realms/test/default-optional-client-scopes' do
         data = JSON.parse(stdout)
         names = data.map { |d| d['name'] }.sort
         expect(names).to include('address')
         expect(names).to include('offline_access')
         expect(names).to include('phone')
       end
     end
 
     it 'has default events config' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get events/config -r test' do
         data = JSON.parse(stdout)
         expect(data['eventsEnabled']).to eq(false)
         expect(data['eventsExpiration']).to be_nil
         expect(data['eventsListeners']).to eq(['jboss-logging'])
         expect(data['adminEventsEnabled']).to eq(false)
         expect(data['adminEventsDetailsEnabled']).to eq(false)
       end
     end
   end
 
   context 'updates realm' do
     it 'runs successfully' do
       pp = <<-EOS
       include mysql::server
       class { 'keycloak':
         datasource_driver => 'mysql',
       }
       keycloak_realm { 'test':
         ensure => 'present',
         remember_me => true,
         access_code_lifespan => 3600,
+        access_token_lifespan => 3600,
         sso_session_idle_timeout => 3600,
         sso_session_max_lifespan => 72000,
         default_client_scopes => ['profile'],
         content_security_policy => "frame-src https://*.duosecurity.com/ 'self'; frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
         events_enabled => true,
         events_expiration => 2678400,
         admin_events_enabled => true,
         admin_events_details_enabled => true,
       }
       EOS
 
       apply_manifest(pp, catch_failures: true)
       apply_manifest(pp, catch_changes: true)
     end
 
     it 'has updated the realm' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get realms/test' do
         data = JSON.parse(stdout)
         expect(data['rememberMe']).to eq(true)
         expect(data['accessCodeLifespan']).to eq(3600)
+        expect(data['accessTokenLifespan']).to eq(3600)
         expect(data['ssoSessionIdleTimeout']).to eq(3600)
         expect(data['ssoSessionMaxLifespan']).to eq(72_000)
         expect(data['browserSecurityHeaders']['contentSecurityPolicy']).to eq("frame-src https://*.duosecurity.com/ 'self'; frame-src 'self'; frame-ancestors 'self'; object-src 'none';")
       end
     end
 
     it 'has updated the realm default-client-scopes' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get realms/test/default-default-client-scopes' do
         data = JSON.parse(stdout)
         names = data.map { |d| d['name'] }
         expect(names).to eq(['profile'])
       end
     end
 
     it 'has updated events config' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get events/config -r test' do
         data = JSON.parse(stdout)
         expect(data['eventsEnabled']).to eq(true)
         expect(data['eventsExpiration']).to eq(2_678_400)
         expect(data['eventsListeners']).to eq(['jboss-logging'])
         expect(data['adminEventsEnabled']).to eq(true)
         expect(data['adminEventsDetailsEnabled']).to eq(true)
       end
     end
   end
 
   context 'creates realm with invalid browser flow' do
     it 'runs successfully' do
       pp = <<-EOS
       include mysql::server
       class { 'keycloak':
         datasource_driver => 'mysql',
       }
       keycloak_realm { 'test2':
         ensure       => 'present',
         browser_flow => 'Copy of browser',
       }
       EOS
 
       apply_manifest(pp, catch_failures: true)
       apply_manifest(pp, expect_changes: true)
     end
 
     it 'has created a realm' do
       on hosts, '/opt/keycloak/bin/kcadm-wrapper.sh get realms/test2' do
         data = JSON.parse(stdout)
         expect(data['browserFlow']).to eq('browser')
       end
     end
   end
 end
diff --git a/spec/unit/puppet/type/keycloak_realm_spec.rb b/spec/unit/puppet/type/keycloak_realm_spec.rb
index c629ca5..cf65b2b 100644
--- a/spec/unit/puppet/type/keycloak_realm_spec.rb
+++ b/spec/unit/puppet/type/keycloak_realm_spec.rb
@@ -1,180 +1,181 @@
 require 'spec_helper'
 
 describe Puppet::Type.type(:keycloak_realm) do
   let(:default_config) do
     {
       name: 'test',
     }
   end
   let(:config) do
     default_config
   end
   let(:resource) do
     described_class.new(config)
   end
 
   it 'adds to catalog without raising an error' do
     catalog = Puppet::Resource::Catalog.new
     expect {
       catalog.add_resource resource
     }.not_to raise_error
   end
 
   it 'has a name' do
     expect(resource[:name]).to eq('test')
   end
 
   it 'has id default to name' do
     expect(resource[:id]).to eq('test')
   end
 
   defaults = {
     login_theme: 'keycloak',
     account_theme: 'keycloak',
     admin_theme: 'keycloak',
     email_theme: 'keycloak',
     access_code_lifespan_user_action: nil,
     access_token_lifespan_for_implicit_flow: nil,
     enabled: :true,
     remember_me: :false,
     login_with_email_allowed: :true,
     browser_flow: 'browser',
     registration_flow: 'registration',
     direct_grant_flow: 'direct grant',
     reset_credentials_flow: 'reset credentials',
     client_authentication_flow: 'clients',
     docker_authentication_flow: 'docker auth',
     content_security_policy: "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
     events_enabled: :false,
     events_listeners: ['jboss-logging'],
     admin_events_enabled: :false,
     admin_events_details_enabled: :false,
   }
 
   describe 'basic properties' do
     # Test basic properties
     [
       :display_name,
       :display_name_html,
       :login_theme,
       :account_theme,
       :admin_theme,
       :email_theme,
       :events_expiration,
       :browser_flow,
       :registration_flow,
       :direct_grant_flow,
       :reset_credentials_flow,
       :client_authentication_flow,
       :docker_authentication_flow,
       :content_security_policy,
     ].each do |p|
       it "should accept a #{p}" do
         config[p] = 'foo'
         expect(resource[p]).to eq('foo')
       end
       next unless defaults[p]
       it "should have default for #{p}" do
         expect(resource[p]).to eq(defaults[p])
       end
     end
   end
 
   describe 'integer properties' do
     # Test integer properties
     [
       :sso_session_idle_timeout,
       :sso_session_max_lifespan,
       :access_code_lifespan,
       :access_code_lifespan_user_action,
+      :access_token_lifespan,
       :access_token_lifespan_for_implicit_flow,
     ].each do |p|
       it "should accept a #{p}" do
         config[p] = 100
         expect(resource[p]).to eq(100)
       end
       next unless defaults[p]
       it "should have default for #{p}" do
         expect(resource[p]).to eq(defaults[p])
       end
     end
   end
 
   describe 'boolean properties' do
     # Test boolean properties
     [
       :remember_me,
       :login_with_email_allowed,
       :internationalization_enabled,
       :events_enabled,
       :admin_events_enabled,
       :admin_events_details_enabled,
     ].each do |p|
       it "should accept true for #{p}" do
         config[p] = true
         expect(resource[p]).to eq(:true)
       end
       it "should accept true for #{p} string" do
         config[p] = 'true'
         expect(resource[p]).to eq(:true)
       end
       it "should accept false for #{p}" do
         config[p] = false
         expect(resource[p]).to eq(:false)
       end
       it "should accept false for #{p} string" do
         config[p] = 'false'
         expect(resource[p]).to eq(:false)
       end
       it "should not accept strings for #{p}" do
         config[p] = 'foo'
         expect {
           resource
         }.to raise_error(%r{foo})
       end
       next unless defaults[p]
       it "should have default for #{p}" do
         expect(resource[p]).to eq(defaults[p])
       end
     end
   end
 
   describe 'array properties' do
     # Array properties
     [
       :default_client_scopes,
       :optional_client_scopes,
       :events_listeners,
       :supported_locales,
     ].each do |p|
       it "should accept array for #{p}" do
         config[p] = ['foo', 'bar']
         expect(resource[p]).to eq(['foo', 'bar'])
       end
       next unless defaults[p]
       it "should have default for #{p}" do
         expect(resource[p]).to eq(defaults[p])
       end
     end
   end
 
   it 'autorequires keycloak_conn_validator' do
     keycloak_conn_validator = Puppet::Type.type(:keycloak_conn_validator).new(name: 'keycloak')
     catalog = Puppet::Resource::Catalog.new
     catalog.add_resource resource
     catalog.add_resource keycloak_conn_validator
     rel = resource.autorequire[0]
     expect(rel.source.ref).to eq(keycloak_conn_validator.ref)
     expect(rel.target.ref).to eq(resource.ref)
   end
 
   it 'autorequires kcadm-wrapper.sh' do
     file = Puppet::Type.type(:file).new(name: 'kcadm-wrapper.sh', path: '/opt/keycloak/bin/kcadm-wrapper.sh')
     catalog = Puppet::Resource::Catalog.new
     catalog.add_resource resource
     catalog.add_resource file
     rel = resource.autorequire[0]
     expect(rel.source.ref).to eq(file.ref)
     expect(rel.target.ref).to eq(resource.ref)
   end
 end