Invalidate tokens with OAuth 2.0 introspection endpoint

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

1. Configure user_oidc with Keycloak
2. Logging a user in Nextcloud
3. Go to Keycloak and delete all sessions of that user

Expected behaviour

The user in Nextcloud is no longer logged in.

Actual behaviour

The user in Nextcloud is still logged in.

In this PR https://github.com/nextcloud/user_oidc/pull/320 the introspection method was added which is just to do this check but it is not used in the whole code base:

https://github.com/nextcloud/user_oidc/blob/b2eb5c482021dba9b9bf2b010e98edfe0ab135df/lib/Service/OIDCService.php#L48

https://github.com/search?q=repo%3Anextcloud%2Fuser_oidc%20introspection&type=code

OAuth 2.0 spec: https://www.oauth.com/oauth2-servers/token-introspection-endpoint/

Server configuration

Web server: Nginx

Database: Maria

PHP version: 8.3

Nextcloud version: 31.0.2

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

Browser

Browser name: Firefox/Chrome/Safari/…

Browser version: 124/125/…

Operating system: Windows/Ubuntu/Mac/…

Insert your browser log here, this could for example include:
a) The javascript console log
b) The network log
c) ...

Start with lib/Service/OIDCService.php around the introspection method added in PR #320, then use the repository search for its current call sites. Reproduce the Keycloak session deletion steps and trace the login/session checks. Done means a user whose Keycloak sessions were deleted is no longer logged in to Nextcloud.