Steps:

• Create a user with manage_token cluster privilege.
• Use the user to generate tokens using API POST _security/oauth2/token and grant_type as password
• Use the user to invalidate the tokens for a user using DELETE _security/oauth2/token with the username/realm_name parameter.

The request to invalidate tokens fails since the search action is not executed in the context of XPackSecurityUser. We need to execute the search action with SECURITY_ORIGIN.

https://discuss.elastic.co/t/what-privileges-are-required-to-invalidate-tokens-by-username/201043