ChrisB.39007 (Customer) asked a question.
Killing mobile App Sessions for everyone in the company
Is there a way to kill app sessions in Okta for everyone in the company? This would be a hypothetical for incident response if a 3rd party vendor was compromised? I know doing so via the admin portal for apps accessed via the desktop version is simple enough, but I wasn't sure if that would stop the API connections for a mobile app that someone is still logged into giving them access to the compromised app.
I hope this makes sense.
Hello @ChrisB.39007 (Customer) Thank you for posting on our Community page!
The short answer is yes, you can kill those mobile API sessions globally, but simply clearing user sessions in the Okta Admin Console will not do it.
When you clear a user's session from the Okta admin portal, you are destroying their Okta browser cookie. If they try to access a web app that redirects to Okta for SAML or OIDC authentication, they will be forced to log in again.
However, mobile applications and API connections generally use OAuth 2.0 / OIDC. Instead of relying on a web session cookie, they are issued two things upon initial login:
If you just clear the user's Okta web session, the mobile app still holds its valid Refresh and Access tokens. The app will continue querying the 3rd-party vendor's API entirely unaware that the Okta web session is dead.
If a 3rd-party vendor is compromised and you need to pull the plug on all access immediately (including mobile and API connections), follow these two steps:
1. Deactivate the Application in Okta
This is your first move to stop the bleeding. In the Okta Admin Console, navigate to the compromised app and deactivate it.
2. Revoke All Tokens via the Okta Admin API
To kill the existing active mobile sessions, you must revoke the refresh tokens that Okta issued to that specific application. Okta provides a specific Admin Management API endpoint for exactly this scenario:
Once this is executed, the mobile app can no longer use its Refresh Token to silently renew the user's session. The next time the app tries to refresh, Okta will deny the request, effectively breaking the API connection and forcing a logout.
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.