Update user attributes when token is refreshed

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Feature request

Which Nextcloud Version are you currently using: 34.0.2

Is your feature request related to a problem? Please describe.

With #1384 implemented, tokens are periodically refreshed. However, if the token claim values change (for example: different name, email, group assignment), the values aren't updated in Nextcloud.

Describe the solution you'd like
To me it would make sense to update the user attributes when the token is refreshed. That would allow for reasonably fast group membership propagation from the idP, which is actually what I'm ultimately after.

I'm not really sure about how this would work with updates that happen while a user is actively interacting with a resource that they lose access to when a group change happens. Should they be redirected? Maybe an error message? I guess that might already be handled by Nextcloud core...

Describe alternatives you've considered
I've tried to set this up by setting the Nextcloud session_lifetime relatively low (like 5 minutes) and disabling the nextcloud login cookie, however, that seems to fully log me out of the idP after 5 minutes of inactivity. By the looks of it thats because TokenInvalidatedListener calls the end_session_endpoint, which seems to be the same endpoint called for user-initiated single logout (if configured). This method would only work after the idle timeout is triggered, so any changes made in the idP would not be propagated until the user idles anyway.

#1449 seems related, but I'm not actually experiencing that issue.

Additional context
I'm using Keycloak as idP.

Start by tracing the token-refresh flow introduced by #1384 and inspect the TokenInvalidatedListener behavior described in the issue. Determine how changed token claims, including group assignments, should propagate to Nextcloud user attributes without relying on idle logout; done means refreshed claims are reflected and the access-change behavior is covered.