401 Unauthorized on Kubeflow dashboard after OIDC token revocation

In a Kubeflow environment utilizing Istio for authentication, the auth-proxy validates OIDC tokens at the request level. While Kubernetes RBAC manages permissions based on OIDC groups, there is a discrepancy between the identity provider's state and the active Istio session.

When a user is deactivated or their credentials are rotated in the OIDC provider, the Kubeflow UI often remains accessible due to local session state. However, subsequent API calls to the dashboard return a 401 Unauthorized error. Because the 'auth' component lacks a native mechanism to force a global invalidation of specific user tokens, these sessions remain active until the JWT naturally reaches its TTL.

Is there a documented method to trigger immediate revocation of active Istio sessions for specific users without implementing custom Envoy filters? Additionally, how can the system be configured to verify the current status of a token against the provider rather than relying solely on JWT expiration dates?