Skip to content

Fixed token revoking call to IdP. - #575

Merged
offtherailz merged 1 commit into
2.6.xfrom
oauth-fix-token-revoking
Jul 9, 2026
Merged

Fixed token revoking call to IdP.#575
offtherailz merged 1 commit into
2.6.xfrom
oauth-fix-token-revoking

Conversation

@axl8713

@axl8713 axl8713 commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

The revoking call in the logout procedure was wrongly sending the access_token instead of the required id_token.
In fact, GeoStore logs showed this:

it.geosolutions.geostore.services.rest.security.oauth2.OAuth2SessionServiceDelegate::logRevokeErrors:1025 - Error while revoking authorization. Error is:
  org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request: "{"error":"unsupported_token_type","error_description":"Unsupported token type"}"

These changes fix the issue, adding also propert testing.

@offtherailz
offtherailz merged commit dc851c3 into 2.6.x Jul 9, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants