Revocation of refresh token also revokes client consent

[derkoe]

Describe the bug

When an OpenID Connect client revokes a refresh token with /auth/realms/{realm}/protocol/openid-connect/revoke the user consent is also being revoked. The Keycloak documentation and the OAuth 2.0 docs do not mention such a behaviour.

Version

16.0.1

Expected behavior

The expected behaviour when revoking a refresh token is that this token (and all related access tokens) will be revoked.

Depending on the authorization server's revocation policy, the
revocation of a particular token may cause the revocation of related
tokens and the underlying authorization grant. If the particular
token is a refresh token and the authorization server supports the
revocation of access tokens, then the authorization server SHOULD
also invalidate all access tokens based on the same authorization
grant (see Implementation Note). If the token passed to the request
is an access token, the server MAY revoke the respective refresh
token as well.

https://datatracker.ietf.org/doc/html/rfc7009#section-2.1

Actual behavior

Keycloak does not only revoke the tokens it also revokes the client consent here:

keycloak/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java

Line 117 in 63614b1

revokeClient();

How to Reproduce?

• Create a access/refresh token for an OpenID Connect client (with consent enabled)
• Call the /auth/realms/{realm}/protocol/openid-connect/revoke endpoint with the refresh token
• Now, the user consent for this application has been removed.

Anything else?

No response

[derkoe]

This issues also exists with offline tokens.

[derkoe]

The actual issue seems to be here:

keycloak/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java

Line 239 in 63614b1

session.users().revokeConsentForClient(realm, user.getId(), client.getId());

[mposolda]

@derkoe The typical use-case for the token revocation is when the particular token is compromised. Hence the reason why there is also revocation of user consent, which is for the security reason. As you cited, specification mentions revocation of a particular token may cause the revocation of related tokens and the underlying authorization grant. and the user consent can be considered a part of the "authorization grant", so I don't see that Keycloak behaviour is incompatible with the specification.

What is exactly your actual use-case for calling token revocation? I wonder if it is an alternative for you to rather call "logout" instead of "token revocation" ? You can call either OIDC logout from the browser or with the logout token (OIDC backchannel logout) or you can call the logout endpoint with the refresh token as a parameter: https://github.com/keycloak/keycloak/blob/18.0.0/services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java#L351

[derkoe]

As you cited, specification mentions revocation of a particular token may cause the revocation of related tokens and the underlying authorization grant. and the user consent can be considered a part of the "authorization grant", so I don't see that Keycloak behaviour is incompatible with the specification.

All other identity providers we tried did not have this "feature" - maybe this should be put behind a configuration.

What is exactly your actual use-case for calling token revocation?

We like to logout from a native mobile application and we were not sure if the refresh token was also invalidated with that logout.

[mposolda]

As you cited, specification mentions revocation of a particular token may cause the revocation of related tokens and the underlying authorization grant. and the user consent can be considered a part of the "authorization grant", so I don't see that Keycloak behaviour is incompatible with the specification.

All other identity providers we tried did not have this "feature" - maybe this should be put behind a configuration.

What is exactly your actual use-case for calling token revocation?

We like to logout from a native mobile application and we were not sure if the refresh token was also invalidated with that logout.

Sure, it is. Logout will automatically invalidate refresh token and all the underlying access tokens as well as session. It won't be possible at all to refresh the token after the logout.

[mposolda]

@derkoe Were you able to use the approach with the logout? Is it possible to close this issue?

[derkoe]

@mposolda yes we used the logout approach.

I think it would be good to put this in the docs: keycloak/keycloak-documentation#1664

[mposolda]

@derkoe I've merged your documentation PR. Thanks for it!