CODEWITHSUNDEEP
azure-active-directorytokenrefreshinvalidation
Matt Jerry
Matt Jerry

Reputation: 521

Azure AD not invalidating access/refresh token if the user is locked out

We are implementing azure AD in a mobile app using ADAL libraries. Given this scenario:

the user has signed into the app - and has valid access and refresh tokens. The user doesnt sign out and from another app - say outlook, user enters password incorrectly multiple times so that the account gets locked out. Post that, go back to the app and we find that the access and refresh tokens are still valid and user can perform all operations which is a security violation. Ideally, when the user's account is locked, it should invalidate the access and refresh tokens. How to get this working properly.

Upvotes: 1

Views: 1672

Answers (1)

Nan Yu
Nan Yu

Reputation: 27528

The access token/refresh token will available in token's lifetime . Log out the web application and block the account won’t revoke the token .

Currently Azure Active Directory does not support or provide an endpoint for an application to revoke the access/refresh tokens.

You may read more about configurable token lifetimes in Azure Active Directory to check the policies on token lifetimes and adjust that base on your requirement .

Upvotes: 1

Related Questions