Invalidate API tokens when LDAP user is invalid

Question

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below.

1. User sends LDAP username and password (with password grand type) to the server.
2. Server validates the password communicating with the LDAP server If valid, server returns an access token and a refresh token.

User keeps accessing APIs with access token until expired. When expired, the refresh token can be used to get a new access token and a new refresh token. The user can keep accessing the APIs forever updating the tokens.

Another requirement is making tokens invalid when user password is changed or when the user is disabled in the LDAP server. Is there anyway to do this?

So far I tried following approach:

Store the LDAP password hash in the server when initially user sends them. When refreshing the token, fetch password hash of the user from the LDAP server and compare them to the one saved in the server. But it looks like it's not always possible to fetch the hash. It depends on the LDAP configuration,directory and Permissions

Answer 1

I've got an idea how to solve this situation not ideally, but it could work. It's kind of hacky. If your LDAP server is OpenLDAP (I'm not so familiar with other servers like 389, opendj or active directory), You can enable accesslog overlay, and search for changes in entries.

So with query in base cn=acceslog like this:

"(&(reqType=modify)(reqStart>=YYYYMMDDhhmmssZ)(|(reqMod=userPassword*)(reqMod=isDisabledAttribute:=disabledFlag))))"

where

• reqType is filtering operation which would be modify
• reqStart is last time you've checked (f.e.: every minute)
• reqMod with userPassword filtering password changes
• isDisabledAttribute - attribute with deciedes whether the user entry is disabled

requiring reqDN will return users DN - then you can get any attribute from his file and invalidate his token in the token storage - I belive you're able to pair it to some attribute form user entry.

Answer 2

Finally I provided a button in the UI for users to logout from all the devices. Pressing this will invalidate all the tokens associate with a user.