# What privileges are required to invalidate tokens by username?

**URL:** <https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 25, 2019, 1:33pm UTC](https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043 "2019-09-25T13:33:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jdmcalee](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@jdmcalee](https://discuss.elastic.co/u/jdmcalee)\
**Post date:** [September 25, 2019, 1:33pm UTC](https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043/1 "2019-09-25T13:33:11Z")

</div>

I am using access tokens for an application, and am having trouble invalidating them for a logout action. I am using an API key to authorize the token requests themselves, with the password grant type to create tokens for each user. I can successfully get, refresh, and invalidate tokens individually using the token and refresh\_token parameters in the invalidate token request.

However, I want to use the username parameter to invalidate any and all tokens for the user. When I attempt to do so, I receive a security\_exception error:

```
action [indices:data/read/search] is unauthorized for user [API TOKEN CREATOR]

```

I am assigning the manage\_token cluster privilege for the API key, and that is all that is required for everything other than using the username parameter. I've tried adding various index privileges including all privileges on all indices:

```
POST _security/api_key
{
  "name": "my-api-key",
  "role_descriptors": {
    "token-manager": {
      "cluster": ["manage_token"],
      "index": [
        {
          "names": ["*"],
          "privileges": ["all"]
        }
      ]
    }
  }
}

```

but I continue to get the same error. This is with version 7.3.0.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\
**Post date:** [September 26, 2019, 4:53am UTC](https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043/2 "2019-09-26T04:53:21Z")

</div>

Hi @jdmcalee,

I think you might be hitting a bug here.

> <https://github.com/elastic/elasticsearch/issues/47151>

Assuming this is what you are trying to do:-

- Create an API key with `manage_token` cluster privilege.
- Use the API key to generate tokens using API `POST _security/oauth2/token` and `grant_type` as `password`
- Use the same API key to invalidate the tokens for a user using `DELETE _security/oauth2/token` with the username parameter.

For now, the workaround would be to given access to `.security*` index names and setting `allow_restricted_indices` to true.  
**I will be cautious with this workaround as it allows the user to access other details from `.security` indices which contains confidential information.**

```auto
POST _security/api_key
{
  "name": "my-api-key",
  "role_descriptors": {
    "token-manager": {
      "cluster": ["manage_token"],
      "index": [
        {
          "names": ["*"],
          "allow_restricted_indices": true,
          "privileges": ["read"]
        }
      ]
    }
  }
}

```

Hope this helps.

---

<div class="post-metadata">

**Author:** ![jdmcalee](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@jdmcalee](https://discuss.elastic.co/u/jdmcalee)\
**Post date:** [September 26, 2019, 1:04pm UTC](https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043/3 "2019-09-26T13:04:28Z")

</div>

One quick follow up. I was trying an entirely different approach, and it seems like the run\_as functionality also doesn't work when authenticating with an API key. Can you confirm that is the case?

---

<div class="post-metadata">

**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\
**Post date:** [September 26, 2019, 1:41pm UTC](https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043/4 "2019-09-26T13:41:38Z")

</div>

That is expected behaviour we do not support `run_as` when authenticated using token or api key.

Regards,  
Yogesh Gaikwad

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2019, 1:41pm UTC](https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043/5 "2019-10-24T13:41:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.