I am looking for a way to invalidate or remove the token that has been issued out to the consumer.
The scenario is when a user's password is changed, we want to make sure all the issued tokens can't not be used anymore.
I am looking for a way to invalidate or remove the token that has been issued out to the consumer.
The scenario is when a user's password is changed, we want to make sure all the issued tokens can't not be used anymore.
There's nothing built-in for this other than the normal expiration. If you think about it, how would you implement this? You'd need to make a call to the STS on every call into your server. That's why normally the token expiration is used -- for efficiency. But if you did want to implement this, you could, but it'd be your custom solution.