Global Token Revocation – Auth0 Universal Logout integration with Okta

Auth0, Extensibility (Workflows and Development), Identity Security, Identity Threat Protection, Workforce Identity Products 1 Minute

Auth0 has launched native support for Global Token Revocation and Okta’s Universal Logout functionality. This means that Auth0 applications now natively support the ability for federated Okta customers to automatically revoke all of the users sessions and tokens when Identity Threat Protection detects malicious or suspicious behaviour. Now, Auth0 powered applications can offer the same logout capabilities previously restricted to popular large SaaS applications like Google Workspace, Apple Business Manager, Microsoft Office 365, Salesforce, Slack, and Zoom.

What is Global Token Revocation?

Global Token Revocation is an extension to the established OpenID Connect back channel logout functionality by revoking refresh tokens as well as user sessions. When a request is received to log out a user it is validated and then

The following diagram from the Auth0 documentation shows how this works.

What is the impact?

The impact on the application user depends on the application type and how it is integrated with Auth0. Applications typically leverage Auth0 sessions, their own sessions or refresh tokens.

  • For browser based applications that leverage Auth0 sessions the user will lose access the next time the application polls the Auth0 session
  • For applications that leverage refresh tokens the user will lose access when their current access token expires and they they try to use their refresh token to get a new one. This time can range from a few seconds up to the maximum access token lifetime

For applications that have implemented OIDC back-channel logout users are instantly logged out.

For more details refer to the release announcement and the documentation.

Published by Toby Allen

Toby Allen is a Solutions Engineer at Okta focussed on enabling simple secure access to technology everywhere powered by Identity. While working in the communications space for 15 years he developed a keen interest in security, particularly in his 5 years working with communications APIs at Twilio and is a CISSP and CCSP. In 2022 he transitioned fulling into the security space at Okta with Identity as the core enabler of Zero trust and secure access. Holding both an MBA and multiple technical certifications he is able to bridge the gap between executives and technical teams to deliver value to his customers.

Published

Leave a Reply