diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 7766fcd..3cf463e 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -817,7 +817,7 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
   struct entidx_enum_proxy_participant eproxypp;
   struct participant *pp;
   struct proxy_participant *proxypp;
-  bool local_perm = false;
+  bool local = false;
   thread_state_awake (lookup_thread_state (), gv);
 
   /* Find participants using this permissions handle */
@@ -830,7 +830,7 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
     {
       uint32_t i = 0;
       ddsrt_avl_citer_t it;
-      local_perm = true;
+      local = true;
       for (struct pp_proxypp_match *ppm = ddsrt_avl_citer_first (&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, &it); ppm; ppm = ddsrt_avl_citer_next (&it), i++)
         pp_proxypp_unrelate_locked (sc, pp, &ppm->proxypp_guid);
     }
@@ -839,7 +839,7 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
   entidx_enum_participant_fini (&epp);
 
   /* Find proxy participants using this permissions handle */
-  if (!local_perm)
+  if (!local)
   {
     entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
     while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
@@ -868,8 +868,49 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
 
 static DDS_Security_boolean on_revoke_identity_cb(const dds_security_authentication *plugin, const DDS_Security_IdentityHandle handle)
 {
-  (void)plugin;
-  (void)handle;
+  struct ddsi_domaingv *gv = plugin->gv;
+  struct entidx_enum_participant epp;
+  struct entidx_enum_proxy_participant eproxypp;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+  bool local = false;
+  thread_state_awake (lookup_thread_state (), gv);
+
+  /* Find participants using this identity handle */
+  entidx_enum_participant_init (&epp, gv->entity_index);
+  while ((pp = entidx_enum_participant_next (&epp)) != NULL)
+  {
+    struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+    ddsrt_mutex_lock (&pp->sec_attr->lock);
+    if (pp->sec_attr->local_identity_handle == handle)
+    {
+      uint32_t i = 0;
+      ddsrt_avl_citer_t it;
+      local = true;
+      for (struct pp_proxypp_match *ppm = ddsrt_avl_citer_first (&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, &it); ppm; ppm = ddsrt_avl_citer_next (&it), i++)
+        pp_proxypp_unrelate_locked (sc, pp, &ppm->proxypp_guid);
+    }
+    ddsrt_mutex_unlock (&pp->sec_attr->lock);
+  }
+  entidx_enum_participant_fini (&epp);
+
+  /* Find proxy participants using this permissions handle */
+  if (!local)
+  {
+    entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
+    while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
+    {
+      bool del_pp;
+      ddsrt_mutex_lock (&proxypp->sec_attr->lock);
+      del_pp = proxypp->sec_attr->remote_identity_handle == handle;
+      ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
+      if (del_pp)
+        delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), false);
+    }
+    entidx_enum_proxy_participant_fini (&eproxypp);
+  }
+
+  thread_state_asleep (lookup_thread_state ());
   return true;
 }
 
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 1e53a8f..ab12143 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -262,7 +262,8 @@ CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_c
   authentication_fini (!exp_fail, !exp_fail);
 }
 
-#define M(n) ((n)*60)
+#define S(n) (n)
+#define M(n) (S(n)*60)
 #define H(n) (M(n)*60)
 #define D(n) (H(n)*24)
 CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
@@ -274,18 +275,18 @@ CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
     /*                       |      |      |      |     */"ca and id1 1min valid",
     /*                       |      |      |      |      |     */"id1 and id2 1s valid, delay 1100ms",
     /*                       |      |      |      |      |      |     */"id1 valid after 1s, delay 1100ms",
-    /*                       |      |      |      |      |      |      |    *//*"ca and id1 expire during session"*/),
-    CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0,     0,     /*0*/     ),   /* CA1 not before */
-    CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  /*2*/     ),  /* CA1 not after (offset from local time) */
-    CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     1,     /*0*/     ),  /* ID1 not before (offset from local time) */
-    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  1,     D(1),  /*2*/     ),  /* ID1 not after (offset from local time) */
-    CU_DataPoints(bool,      false, true,  true,  false, false, true,  false, /*false*/ ),  /* expect validate local ID1 fail */
-    CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     /*0*/     ),  /* ID2 not before (offset from local time) */
-    CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  1,     D(1),  /*D(1)*/  ),  /* ID2 not after (offset from local time) */
-    CU_DataPoints(bool,      false, true,  false, true,  false, true,  false, /*false*/ ),  /* expect validate local ID2 fail */
-    CU_DataPoints(uint32_t,  0,     0,     0,     0,     0,     1100,  1100,  /*0*/     ),  /* delay (ms) after generating certificate */
-    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     /*3500*/  ),  /* write/read data during x ms */
-    CU_DataPoints(bool,      false, false, false, false, false, false, false, /*true*/  ),  /* expect read data failure */
+    /*                       |      |      |      |      |      |      |     */"id1 expire during session"),
+    CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0,     0,     0     ),  /* CA1 not before */
+    CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  D(1)  ),  /* CA1 not after (offset from local time) */
+    CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     S(1),  0     ),  /* ID1 not before (offset from local time) */
+    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  S(1),  D(1),  S(2)  ),  /* ID1 not after (offset from local time) */
+    CU_DataPoints(bool,      false, true,  true,  false, false, true,  false, false ),  /* expect validate local ID1 fail */
+    CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     0     ),  /* ID2 not before (offset from local time) */
+    CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  S(1),  D(1),  D(1)  ),  /* ID2 not after (offset from local time) */
+    CU_DataPoints(bool,      false, true,  false, true,  false, true,  false, false ),  /* expect validate local ID2 fail */
+    CU_DataPoints(uint32_t,  0,     0,     0,     0,     0,     1100,  1100,  0     ),  /* delay (ms) after generating certificate */
+    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     3500  ),  /* write/read data during x ms */
+    CU_DataPoints(bool,      false, false, false, false, false, false, false, true  ),  /* expect read data failure */
 };
 CU_Theory(
   (const char * test_descr, int32_t ca_not_before, int32_t ca_not_after,