[christopher-svensson-stegra]

OIDC group mappings already override a user’s role when they match. When the last matching group is removed, the previous role is currently retained. Changing default_role also leaves existing unmatched accounts unchanged.

Add an opt-in setting:

[oidc]
# Other provider settings omitted.
default_role = "operator"
sync_role_on_login = true

With synchronization enabled, every successful OIDC login applies the highest role mapped from the validated ID token’s groups, or default_role when none match. The stored role does not participate in that decision. A matching viewer mapping still wins over an operator default: the default is a fallback, not a minimum.

Typical uses:

• An administrator leaves the remote-admins group and returns to the default role on their next login, rather than retaining admin access.
• An organization changes its default from viewer to operator; existing unmatched users adopt that default on their next login.
• An IdP-managed installation overwrites manual role changes at the next login while keeping pre-provisioning (auto_create_users = false) and account-disable checks.

The option defaults to false, preserving existing role-assignment behavior. Role lookup or persistence errors reject the login rather than issuing a session with stale privileges. Reconciliation runs before creating the new auth session; it does not poll the IdP, revalidate on every request, or terminate active remote desktop sessions. Local API-key admins are unaffected.

Includes configuration documentation, examples, and regressions for promotion, demotion, default changes, explicit lower mappings, compatibility mode, and database failures.