Tokens not revoked in APIM GW

[vikumkbv]

Description

Hi Team,

We have observed the following behavior in APIM 3.1.0 with IS-as-KM setup with is 5.10.0 [1]: users are able to invoke APIs using the old access token (JWT) even after it has been renewed using the refresh_token grant.

In the IDN_OAUTH2_ACCESS_TOKEN_AUDIT table, the previous token is in the INACTIVE state, while in the IDN_OAUTH2_ACCESS_TOKEN table, we have the new token in the ACTIVE state. Please refer to the following screenshot from the database.

Steps to reproduce

1. Get the APIM 3.1.0 u2 217 pack and create an API
2. Generate the JWT token and invoke the API (use the following curl)
   curl -k -X POST https://localhost:8243/token -d "grant_type=password&username=admin&password=admin" -H "Authorization: Basic VzdPT3pCbHQ3bEFhenE3alBCRVRLeFNOM2ZnYTpvX2dETXlKNXp4cHNGQVN5ZXZid2ZNUk1vWVVh"

3.Then renew the access token using refresh_grant and invoke the API.
curl -k -d "grant_type=refresh_token&refresh_token=<refresh token>" -H "Authorization: Basic VzdPT3pCbHQ3bEFhenE3alBCRVRLeFNOM2ZnYTpvX2dETXlKNXp4cHNGQVN5ZXZid2ZNUk1vWVVh" -H "Content-Type: application/x-www-form-urlencoded" https://localhost:8243/token

4. Then try to invoke the API again using the access token generated in step 2, as we have renewed this token at step 3, this invocation should give the following error with 401 status code, but we were able to invoke api without any error using this old token.

<ams:fault xmlns:ams="http://wso2.org/apimanager/security">
  <ams:code>900901</ams:code>
  <ams:message>Invalid Credentials</ams:message>
  <ams:description>Invalid JWT token. Make sure you have provided the correct security credentials</ams:description>
</ams:fault>

Hope we need to fix this

Setup details

APIM 3.1.0 - U2 217
wso2is-km-5.10.0 - U2 223

[1] https://apim.docs.wso2.com/en/3.1.0/install-and-setup/setup/distributed-deployment/configuring-wso2-identity-server-as-a-key-manager/

Thanks,
Vikum

Steps to Reproduce

N/A

Affected Component

APIM

Version

3.1.0

Environment Details (with versions)

No response

Relevant Log Output

No response

Related Issues

No response

Suggested Labels

No response

[dulithsenanayake]

Hi all,

Since this U2 update has already been released, we are closing this public git issue.

Thanks,
Dulith