SONAR-15381 Document removing tokens for authenticated users in SQ

diff --git a/server/sonar-docs/src/pages/instance-administration/delegated-auth.md b/server/sonar-docs/src/pages/instance-administration/delegated-auth.md
index 02879451f8a6daaf1086cffd4279525d71d3b20b..c259d6bc4df078f734fa4c568e286efb8aceec9b 100644 (file)
--- a/server/sonar-docs/src/pages/instance-administration/delegated-auth.md
+++ b/server/sonar-docs/src/pages/instance-administration/delegated-auth.md
@@ -3,7 +3,6 @@ title: Delegating Authentication
 url: /instance-administration/delegated-auth/
 ---
 
-
 SonarQube comes with an onboard user database, as well as the ability to delegate authentication via HTTP Headers, GitHub Authentication, GitLab Authentication, SAML, or LDAP. Each method offers user identity management, group synchronization/mapping, and authentication.
 
 ## Group Mapping
@@ -13,8 +12,7 @@ When using group mapping, the following caveats apply regardless of which delega
 * membership in the default group `sonar-users` remains (this is a built-in group) even if the group does not exist in the identity provider
 
 [[warning]]
-|When group mapping is configured, the delegated authentication source becomes the one and only place to manage group membership, and the user's groups are re-fetched with each log in.
-
+|When group mapping is configured, the delegated authentication source becomes the only place to manage group membership, and the user's groups are re-fetched with each log in.
 
 ## HTTP Header Authentication
 You can delegate user authentication to third-party systems (proxies/servers) using HTTP Header Authentication. See `SSO AUTHENTICATION` section within `sonar.properties` file.
@@ -238,3 +236,6 @@ If you are changing your delegated authentication method and migrating existing
 
 * Time out when running SonarQube analysis using LDAP
 Java parameters are documented here: http://docs.oracle.com/javase/jndi/tutorial/ldap/connect/config.html. Such parameters can be set in `sonar.web.javaAdditionalOpts` in _$SONARQUBE-HOME/conf/sonar.properties_.
+
+## Revoking tokens for deactivated users
+When SonarQube authentication is delegated to an external identity provider (LDAP, SAML, GitHub, or GitLab), deactivating a user on the identity provider side does not remove any tokens associated with the user on the SonarQube side. We recommend deactivating the user in SonarQube at **Administration > Security > Users** by selecting **Deactivate** from the ![Settings drop-down](/images/gear.png) drop-down menu to ensure tokens associated with that user can no longer be used.