Interaction between IdP group mapping and RBAC during session timeouts

Teleport utilizes a Role-Based Access Control (RBAC) system to manage resource access via labels, while integrating with external Identity Providers (IdP) to map user groups to these roles. The Proxy service serves as the authenticated gateway to internal infrastructure.

When a user session reaches its timeout period, there is uncertainty regarding how the system re-evaluates permissions if the user's group membership has changed within the IdP but the local session token persists or is being refreshed.

Does the Teleport Proxy force a full re-synchronization of IdP group mappings upon session expiration, or does it rely on the cached role assignments until a new login flow is initiated? Which mechanism ensures that a user removed from an IdP group loses access to associated RBAC labels immediately upon session timeout?