Anyone do the kerberos way, with two lifetimes? In theory this allows one time authentication, paired with continuous renewal - where refusing renewal becomes a way to invalidate the session/ticket (by way of expiration):

https://stackoverflow.com/questions/14682153/lifetime-of-ker...

Ed: Note that the service doing the renewal won't need the user/password - only a way to check if the user is blacklisted, as well as a way to sign/make tokens - and doesn't have to be the same system that issues the initial token.