Can OpenShift enforce immediate revocation of all active OAuth tokens for a user when their identity provider credentials are disabled?
Goal To maintain a strict least‑privilege posture, an OpenShift cluster must ensure that once a user’s identity provider credentials are revoked or disabled, no active OAuth session or service‑account token remains usable beyond the configured token lifetime. Constraints OpenShift’s OAuth configuration exposes accessTokenMaxAgeSeconds (default 86400 s) to go
redhat