Due to PR https://github.com/ComplianceAsCode/content/pull/11423, for rule  ocp4-oauth-or-oauthclient-token-maxage, the variable ocp4-var-oauth-token-maxage should be set to make the rule PASS(if you don't want to use the default value). 

compliance-operator.v1.4.1    

Always    

Install Compliance OperatorCheck the yaml output of the rule  ocp4-oauth-or-oauthclient-token-maxage     

% oc get rule ocp4-oauth-or-oauthclient-token-maxage -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp4hrxvx",
  "compliance.openshift.io/profiles": "ocp4-stig,ocp4-high-rev-4,ocp4-moderate,ocp4-high,ocp4-moderate-rev-4,ocp4-nerc-cip,ocp4-stig-v1r1",
  "compliance.openshift.io/rule": "oauth-or-oauthclient-token-maxage",
  "control.compliance.openshift.io/NIST-800-53": "AC-12",
  "policies.open-cluster-management.io/controls": "AC-12",
  "policies.open-cluster-management.io/standards": "NIST-800-53"
}
% oc get rule ocp4-oauth-or-oauthclient-token-maxage -o=jsonpath={.instructions}
To check if the OAuth server token max age is configured, run the following command:
oc get oauth cluster -ojsonpath='{.spec.tokenConfig.accessTokenMaxAgeSeconds}'
the output should return a timeout value
To check if the OAuth client token max age is configured, run the following command:
oc get oauthclients -ojson | jq -r '.items[] | { accessTokenMaxAgeSeconds: .accessTokenMaxAgeSeconds}'
the output should return a timeout value per client.%      
 
% oc get rule ocp4-oauth-or-oauthclient-token-maxage -o=jsonpath={.description}
You can configure OAuth tokens to have have a custom duration. By default, the tokens are valid for 24 hours (86400 seconds).
The maximum age can be either set in the OAuth server configuration or in any of the OAuth clients. The client settings override the OAuth server setting.
To set the OAuth server token max age, edit the OAuth server object: oc edit oauth cluster and set the.spec.tokenConfig.accessTokenMaxAgeSeconds parameter to the desired value:
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
...
spec:
  tokenConfig:
    accessTokenMaxAgeSeconds: 28800
To set the OAuth client token max age, edit the OAuth client object: oc edit oauthclient $clientname and set the top-level accessTokenMaxAgeSeconds attribute.
apiVersion: oauth.openshift.io/v1
grantMethod: auto
kind: OAuthClient
metadata:
...
accessTokenMaxAgeSeconds: 28800
For more information on configuring the OAuth server, consult the OpenShift documentation: https://docs.openshift.com/container-platform/4.7/authentication/configuring-internal-oauth.html

1. There should be "compliance.openshift.io/rule-variable: var-oauth-token-maxage" added in the the rule annotation.
2. For the instruction, should use "the output should return a targeted timeout value per client" rather than "the output should return a timeout value per client"