4

Per the Magento 2 developer documentation

When you make web API calls, you supply this token in the Authorization request header with the Bearer HTTP authorization scheme to prove your identity. The token never expires but it can be revoked.

As a system owner -- how do I revoke an authorization token? Is it as simple as setting the revoked column in the oauth_token to 1? Or do I need to do more.

Irrespective of that, is there a GUI for doing this anywhere? Or do I need to manually edit the database myself?

3 Answers 3

3

It is actually just the Force Sign-In on the User Info section of the users page.

2
  • I get this error This customer has no tokens. Apr 26, 2018 at 12:39
  • @DhadukMitesh , which means, this customer is not logged in from any device through API login token.
    – Nahid
    Apr 14, 2020 at 5:57
2

I reckon the controller action class related to what you're looking for is Magento\User\Controller\Adminhtml\User\InvalidateToken.php:

public function execute()
{
    if ($userId = $this->getRequest()->getParam('user_id')) {
        try {
            $this->tokenService->revokeAdminAccessToken($userId);
            $this->messageManager->addSuccess(__('You have revoked the user\'s tokens.'));
            $this->_redirect('adminhtml/*/edit', ['user_id' => $userId]);
            return;
        } catch (\Exception $e) {
            $this->messageManager->addError($e->getMessage());
            $this->_redirect('adminhtml/*/edit', ['user_id' => $userId]);
            return;
        }
    }
    $this->messageManager->addError(__('We can\'t find a user to revoke.'));
    $this->_redirect('adminhtml/*');
}

It is trigerred by clicking the Force Sign-in button on the user edit page Magento\User\Block\User\Edit.php:

if (!empty($objId)) {
        $deleteConfirmMsg = __("Are you sure you want to revoke the user\'s tokens?");
        $this->addButton(
            'invalidate',
            [
                'label' => __('Force Sign-In'),
                'class' => 'invalidate-token',
                'onclick' => 'deleteConfirm(\'' . $deleteConfirmMsg . '\', \'' . $this->getInvalidateUrl() . '\')',
            ]
        );
    }

The function that actually sets the revoked column to 1 can be found under /Magento/Integration/Model/AdminTokenService.php :

public function revokeAdminAccessToken($adminId)
{
    $tokenCollection = $this->tokenModelCollectionFactory->create()->addFilterByAdminId($adminId);
    if ($tokenCollection->getSize() == 0) {
        throw new LocalizedException(__('This user has no tokens.'));
    }
    try {
        foreach ($tokenCollection as $token) {
            $token->setRevoked(1)->save();
        }
    } catch (\Exception $e) {
        throw new LocalizedException(__('The tokens could not be revoked.'));
    }
    return true;
}
1
protected $_customerTokenServiceFactory;

public function __construct(\Magento\Integration\Model\CustomerTokenService $customerTokenServiceFactory)
{
   $this->_customerTokenServiceFactory = $customerTokenServiceFactory;
}


public function revokeCustomerAccess($customerId)
{
   $this->_customerTokenServiceFactory->revokeCustomerAccessToken($customerId); 
}
1
  • 2
    Could you please add to your answer what your code is doing and how it will solve the OP's problem?
    – 7ochem
    Mar 13, 2017 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.