I'm developing a hybrid mobile app that wraps Salesforce1 UI (/one/one.app) of communities. My community uses SSO and Auth Providers to login a user against their home org Salesforce credentials.
The problem that I'm trying to answer is where to derive the refresh token for the app. If I use the application provider (my community org) to derive the refresh token, then I have no way of know in my community when/if that user has been deactivated from his/her home org. A user could potentially login to the app long past the time that person should have access to the community. If I use the user's home org as the source of their refresh token, I have to support an auth flow that I'm not sure the hybrid SDK was designed to support, and I've noticed issues on session timeouts.
Some options I've explored but haven't implemented yet are using the Identity API to poll a user's home org periodically to find out if the user is still active and then deactivate the user accordingly in the community.
Other ideas or opinions?