ARTIFACTORY: How to troubleshoot “Failed to revoke tokens” when trying to revoke a token through the UI

Introduction

In this article, we will outline the process on how to revoke tokens when you encountered with the error of “Failed to revoke tokens”
Identity tokens are the credentials to be used instead of basic authentication. Hence, tokens could either be with an expiry date or without an expiry date.
At times, it may be necessary to revoke our token. To do this in the user interface (UI), navigate to the "Edit Profile" page and enter your password. This will display the Identity Tokens table, from which you can select the token to be deleted. For example:

 

Tokens without an expiry are always revocable. However, users that have expirable tokens might be unable to complete the revoke operation and it will fail with the below error message:

 

In the logs (frontend-service.log or console.log), we will see the below ERROR: 

[jffe ] [ERROR] [xxxxxxxxxxx] [frontend-service.log] [main                ] - http [delete] request to /api/v1/tokens/cccccccccccccc failed with 400 code

Verification

- Navigate to the $JFROG_HOME/artifactory/var/etc/access folder
- Verify if access.config.latest.yml file contains the below block: 

token:
  revocation:
    revocable-expiry-threshold: -1

Which means all tokens that have an expiration date are non-revocable and thus explains the observed failure of revoking the Identity Token the user attempted to perform.


Resolution

How can we resolve this issue and have all users revoke their own identity token? In the steps below, we will illustrate on how to remediate the error:
1. Edit /opt/jfrog/artifactory/var/etc/access/access.config.latest.yml
2. Update the value for "revocable-expiry-threshold", save, and exit. 

Then I updated the access.config.latest.yml file with the default settings of 21600 seconds:

token:
  revocation:
    revocable-expiry-threshold: 21600

- You might replace its value with the default value which is 21600. (21600 is in seconds which means 6 hours). 
   For more information please review Access Tokens and Access Yaml Configuration wiki pages.
- Note that a token with an expiry date that is lower than the revocable-expiry-threshold value cannot be revoked.

 3. Rename access.config.latest.yml to access.config.import.yml. Artifactory will use this file to update the configurations in the database.
 4. Restart Artifactory for new configurations to take effect.
 5. Revoke the aforementioned token.

Note 
If you have an HA cluster setup with more than one node, then we can update the parameter in access.config.latest.yml in one node and it will propagate in other node then rename access.config.latest.yml to access.config.import.yml and perform restart to both the nodes for new configurations to take effect