jty | springspringmvchibernateshiroquartzmaveneasyui | Build Tool library

JTI claim value is just a random UUID which is stored nowhere. What you are looking for is session_state param which is the session ID. When you pass access_token to /userinfo endpoint Keycloak retrieves session_state value and searches for the corresponding session in the distributed cache (Infinispan).

After you click on logout all sessions button Keycloak clears all the sessions in the cache.

UPDATE

https://www.keycloak.org/docs/latest/server_admin/index.html#compromised-access-and-refresh-tokens

Another thing you can do to mitigate leaked access tokens is to shorten their lifespans. You can specify this within the timeouts page. Short lifespans (minutes) for access tokens for clients and applications to refresh their access tokens after a short amount of time. If an admin detects a leak, they can logout all user sessions to invalidate these refresh tokens or set up a revocation policy. Making sure refresh tokens always stay private to the client and are never transmitted ever is very important as well.

There is more information about security considerations on the link above.

Token Blacklisting

There is no such a thing as Token Blacklist in Keycloak and it should not be. Tokens are issued on behalf of the user or service account for particular client. So If you want to give a regular user access to some service protected by Keycloak you just create this user in Keycloak Admin Console. For third-party apps in machine-to-machine communication you create a client with service account enabled and third-party app uses its client_id and secret to issue access and refresh tokens on behalf of itself.

Instead of blacklisting a token you just logout (delete from the cache) user's or client's session.

If you want to completely remove your partner's access to API you can just disable client (admin -> clients -> client -> set enabled to false) or user (admin -> users -> user -> set enabled to false).