Revoke access for an access_token received via MS Active Directory authentication

user_5899088 0
Viewed 175

I am currently using passport-azure-ad and @azure/msal-node nodejs library to authenticate users for my APIs. When the user successfully authenticates via his/her microsoft account we receive an access_token, the user can call our APIs with that access_token. Now if we disable the user's account from the Azure admin panel, the user's already existing access_token should be invalidated and he/she should not be able to call our APIs with that access_token.

How can we do this please?

passport-azure-ad msal passport.js active-directory
1 Answers

Basically, you can't.

I believe that the spec. doesn't allow access tokens to be revoked.

You can, however, revoke refresh tokens.

When the access token expires, the refresh token won't be honoured and the user will be logged out.

Going forward, continuous access evaluation will be of use but it hasn't been implemented in many apps. to date.

nzpcmad_99220
Related