Can OpenShift enforce immediate revocation of all active OAuth tokens for a user when their identity provider credentials are disabled?

Goal

To maintain a strict least‑privilege posture, an OpenShift cluster must ensure that once a user’s identity provider credentials are revoked or disabled, no active OAuth session or service‑account token remains usable beyond the configured token lifetime.

Constraints

OpenShift’s OAuth configuration exposes accessTokenMaxAgeSeconds (default 86400 s) to govern the lifetime of user access tokens. Service‑account tokens created as secrets are long‑lived and do not automatically expire with the OAuth token, while projected TokenRequest API tokens can be bounded to a short lifetime. Revoking a token object invalidates the session it represents, but other active sessions for the same identity remain valid until their own expiry. The current platform does not provide a cluster‑wide, immediate revocation mechanism triggered by an identity provider state change.

Unresolved Question

Can OpenShift enforce immediate revocation of all active OAuth tokens for a user when their identity provider credentials are disabled, or should the system continue to honor existing tokens until their configured expiration?