Bug description
Inconsistent behavior while revoking stateful v/s stateless refresh tokens.
How to reproduce the issue
Revoke stateful refresh token
- Acquire stateful access and refresh tokens using any OAuth grant : accesstoken1 and refreshtoken1
- Refresh accesstoken1 using refreshtoken1, accesstoken2 and refreshtoken2 are issued
- Revoke refreshtoken1
- There is no impact on refreshtoken2
Revoke stateless refresh token
- Acquire stateless access and refresh tokens using any OAuth grant : accesstoken1 and refreshtoken1
- Refresh accesstoken1 using refreshtoken1, accesstoken2 and refreshtoken2 are issued
- Revoke refreshtoken1
- refreshtoken2 is also revoked
Expected behaviour
Revoking stateless refreshtoken1 should have no impact on refreshtoken2
Current behaviour
Revoking stateless refreshtoken1 also revokes refreshtoken2
This may be related to OPENAM-13047