Fix: PATs are not restricted in SSO user accounts anymore

[MuchoLucho]

For context check on MEN-6725

Changelog: None
Ticket: None

External Contributor Checklist

🚨 Please review the guidelines for contributing to this repository.

• Make sure that all commits follow the conventional commit specification for the Mender project.

The majority of our contributions are fixes, which means your commit should have
the form below:

fix: <SHORT DESCRIPTION OF FIX>

<OPTIONAL LONGER DESCRIPTION>

Changelog: <USER-FRIENDLY-CHANGE-DESCRIPTION> or <None>
Ticket: <TICKET NUMBER> or <None>

• Make sure that all commits are signed with git --signoff. Also note that the signoff author must match the author of the commit.

Description

Please describe your pull request.

Thank you!

[nickanderson]

Actually, I think that we should call out the fact that if you are using external authentication like SAML SSO (i guess oauth as well or oidc) that disabling the user at the IDP is not sufficient to disable their personal access tokens. It must be done explicitly for the user (thought it will be revoked/invalidated) on specific account actions (plan level change, add-on add/removal). I wish we had an exhaustive list of what actions cause the PAT invalidation.

[MuchoLucho]

@nickanderson I agree. But I don't think it necesarily should be part of this PR. What do you think?

[nickanderson]

I do think we should call it out. To me it makes sense that it's in the same PR, it looks like there is a PAT section just above that is maybe a reasonable place to add a warning.

@olehermanse Opinion?

[nickanderson]

Looks good to.me