**As** a user
**I want to** use SSO once and have Nextcloud Begin of the insertion(NC)End of the insertion integration working right away 
**so that** there is no need for me taking the extra steps of completing OAuth2 grant flows again and again,

**Acceptance criteria**

* Begin of the insertionUser's OIDC access and refresh tokens are saved to the database, along with the audience where they can be used.

* When storage is configured for authentication through central OIDC provider (IDP):

* End of the insertion Nextcloud queries and commands that act on user's Begin of the insertionbehalf,End of the insertion Begin of the deletion behalf are able toEnd of the deletion use Begin of the deletion OIDCEnd of the deletion access Begin of the deletion token instead of OAuth2 bearer token.

* OIDCEnd of the deletion tokens Begin of the insertionissued by IDPEnd of the insertion Begin of the deletion are savedEnd of the deletion to Begin of the insertionauthenticate requests (used token must have NC as audience)

End of the insertion Begin of the deletion the database.

End of the deletion * Begin of the insertionExpired access\_tokens areEnd of the insertion Begin of the deletion OIDC access\_token isEnd of the deletion refreshed when Begin of the insertionexpired

End of the insertion Begin of the deletion expired.

End of the deletion * Begin of the insertionWhen no access token has the required audience, token exchange at the IDPEnd of the insertion Begin of the deletion OIDC refresh\_token expirationEnd of the deletion is Begin of the insertionattempted

End of the insertion Begin of the deletion handled automatically. If possible automatically in backgroun otherwise user have to relogin.

End of the deletion * Begin of the insertionWhen storageEnd of the insertion Begin of the deletion OIDC access\_tokenEnd of the deletion is Begin of the insertionconfigured for two-way OAuth 2, the authentication behaviour remains the same as before.End of the insertion Begin of the deletion exchanged using Token Exchange if it does not include required audience.End of the deletion