Is there any way to revoke “refresh token” for a connected app automatically as soon user changes password?

Question

We have a requirement for revoking refresh token if a user changes password. In our use-case a business user may be logged into multiple devices with the same user id and are using Hybrid App based on SF Mobile SDK for authentication process only.

Currently, since refresh token in long lived, even though user has changed the password, the existing sessions with Refresh and access token continue to work. I think this is by design how OATUH is supposed to work. Changing the password does not mean that I have to go and re-authorize all connected app.

However business here would like to force user to re-login and get a new refresh and access token incase of password change.

We know how to revoke the refresh token from client however I am not sure if there is any setting at the server level that I can turn on to invalidate the refresh token.

Answer 1

There is no setting to automatically expire refresh tokens when the user changes their password. Here are some ideas that may help you solve your problem:

Use an Implicit Flow Instead

If you are developing a mobile app, it might be better to skip refresh tokens altogether, and use an implicit flow instead. This works best if the user is "online" and active any time your app connects to the Salesforce API.

For comparison, in general there are two different OAuth 2.0 flows apps can use:

In the implicit flow, the app redirects the user to Salesforce, the user logs in to Salesforce, and the app receives a short-lived access token. The user needs to log in every time the access token expires.

In the webserver flow, the app redirects the user to Salesforce, the user logs in to Salesforce, the app receives a temporary code, and the app sends the code to the Salesforce servers to get back a token. In this flow, the token can be a long-lived refresh token. The refresh token can be exchanged repeatedly for an access token, while the user does not need to log in again.

Set a Refresh Token Expiration Policy

While you can't expire refresh tokens on password change, you can expire refresh tokens after a configurable amount of time using a Refresh Token Policy for your connected app under Manage Apps > Connected Apps > Edit.

Write a Script

You could program your own periodic check of User.LastPasswordChangeDate, which together with OauthToken.DeleteToken would allow you to revoke a refresh token programatically. You would call https://login.salesforce.com/services/oauth2/revoke?token={DeleteToken} to trigger the revocation. Note that depending on how your connected app is implemented, this could cause problems, as the token exchange process breaks down. The app would have to ask the user to authenticate again.