title: Identityserver4 doesn't revoke access tokens when calling end_session_endpoint
body: <p>After a successful signout from identity server 4 (I see the log message AuthenticationScheme: idsrv signed out.), The actual access token is still valid. Hence, with this access token, I can still access my APIs.</p>
  <p>I can invalidate these tokens myself by calling:</p>
  <pre class="lang-cs prettyprint-override"><code>_persistedGrantService.RemoveAllGrantsAsync(logoutContext.SubjectId, null, logoutContext.SessionId);
  </code></pre>
  <p>but I wonder if this is the right approach since I'm expecting that by calling the end_session_endpoint this administration would be handled by the identity server.
  Is there something that I'm doing wrong?</p>
  <p>My sign out method looks like this:</p>
  <pre class="lang-cs prettyprint-override"><code>await HttpContext.SignOutAsync();
  var logoutContext = await _interactionService.GetLogoutContextAsync(logoutId);
  if (logoutContext == null)
  {
      return NotFound();
  }
  
  // Is this needed?
  await _persistedGrantService.RemoveAllGrantsAsync(logoutContext.SubjectId, null, logoutContext.SessionId);
  
  SignOutIframeUrl = logoutContext.SignOutIFrameUrl;
  
  var externalIdp = await GetExternalIdpAsync();
  if (externalIdp != null)
  {
      // build a return URL so the upstream provider will redirect back
      // to us after the user has logged out. this allows us to then
      // complete our single sign-out processing.
      var url = Url.Page(&quot;SignOut&quot;, new {logoutId});
  
      // this triggers a redirect to the external provider for sign-out
      return SignOut(new AuthenticationProperties {RedirectUri = url}, externalIdp);
  }
  
  if (logoutContext.PostLogoutRedirectUri != null)
  {
      return Redirect(logoutContext.PostLogoutRedirectUri);
  }
  
  return Page();
  
  
  </code></pre>