The token is invalidated, as with any identity system. That's how it should work. Think certificate revocation lists, for example. The identity provider has to

The token is invalidated, as with any identity system. That's how it should work. Think certificate revocation lists, for example. The identity provider has to be able to revoke certs, or the entire trust model would fall apart.