Repository navigation
How to revoke a token granted to a client through client_credentials grant type?
#46869
|
We have a few clients that get their tokens from the Would one of these tokens be compromised, how can we revoke it? I am conscisous that revoking it woud be useless if the resource server does not call the token introspection endpoint to check the token validatity, but let's admit that this is what we plan on doing, how would be able to revoke the tokens to begin with? It is quite straightforward for users, but for clients the Session tab always display an empty list. We also tried to regenerate the Client Secret but it does not revoke the previsously granted tokens. |
Replies: 1 comment 2 replies
|
@ericmorand , you can revoke client tokens using standard Token Revocation endpoint (https://datatracker.ietf.org/doc/html/rfc7009) |
|
Thank you. Do you confirm that there is no way to revoke a token from the GUI? Our support team can't be asked to execute an endpoint whenever a key needs to be revoked. |
|
Since, there's no session in case of client credentials maintained, hence I doubt if there's any way from GUI since GUI only shows user based sessions. |
@ericmorand , you can revoke client tokens using standard Token Revocation endpoint (https://datatracker.ietf.org/doc/html/rfc7009)
It is already supported in keycloak and you can extract it using well-known endpoint
/realms/{realm-name}/.well-known/openid-configurationFor ex. it would look like
/realms/{realm-name}/protocol/openid-connect/revoke