@@ -371,6 +371,7 @@ func NewFactory(clientConfig kclientcmd.ClientConfig) *Factory {

 				client.GroupsInterface(oc),

 				client.ClusterRoleBindingsInterface(oc),

 				client.RoleBindingsNamespacer(oc),

+				client.OAuthClientAuthorizationsInterface(oc),

 				kclient.SecurityContextConstraintsInterface(kc),

 			), nil

 		case userapi.Kind("Group"):

@@ -17,6 +17,7 @@ func NewUserReaper(

 	groupClient client.GroupsInterface,

 	clusterBindingClient client.ClusterRoleBindingsInterface,

 	bindingClient client.RoleBindingsNamespacer,

+	authorizationsClient client.OAuthClientAuthorizationsInterface,

 	sccClient kclient.SecurityContextConstraintsInterface,

 ) kubectl.Reaper {

 	return &UserReaper{

@@ -24,6 +25,7 @@ func NewUserReaper(

 		groupClient:          groupClient,

 		clusterBindingClient: clusterBindingClient,

 		bindingClient:        bindingClient,

+		authorizationsClient: authorizationsClient,

 		sccClient:            sccClient,

 	}

 }

@@ -33,6 +35,7 @@ type UserReaper struct {

 	groupClient          client.GroupsInterface

 	clusterBindingClient client.ClusterRoleBindingsInterface

 	bindingClient        client.RoleBindingsNamespacer

+	authorizationsClient client.OAuthClientAuthorizationsInterface

 	sccClient            kclient.SecurityContextConstraintsInterface

 }

@@ -91,6 +94,21 @@ func (r *UserReaper) Stop(namespace, name string, timeout time.Duration, gracePe

 		}

 	}

+	// Remove the user's OAuthClientAuthorizations

+	// Once https://github.com/kubernetes/kubernetes/pull/28112 is fixed, use a field selector

+	// to filter on the userName, rather than fetching all authorizations and filtering client-side

+	authorizations, err := r.authorizationsClient.OAuthClientAuthorizations().List(kapi.ListOptions{})

+	if err != nil {

+		return err

+	}

+	for _, authorization := range authorizations.Items {

+		if authorization.UserName == name {

+			if err := r.authorizationsClient.OAuthClientAuthorizations().Delete(authorization.Name); err != nil && !kerrors.IsNotFound(err) {

+				return err

+			}

+		}

+	}

+

 	// Intentionally leave identities that reference the user

 	// The user does not "own" the identities

 	// If the admin wants to remove the identities, that is a distinct operation

@@ -12,6 +12,7 @@ import (

 	authorizationapi "github.com/openshift/origin/pkg/authorization/api"

 	"github.com/openshift/origin/pkg/client/testclient"

+	oauthapi "github.com/openshift/origin/pkg/oauth/api"

 	authenticationapi "github.com/openshift/origin/pkg/user/api"

 )

@@ -173,6 +174,32 @@ func TestUserReaper(t *testing.T) {

 				ktestclient.DeleteActionImpl{ActionImpl: ktestclient.ActionImpl{Verb: "delete", Resource: "users"}, Name: "bob"},

 			},

 		},

+		{

+			name: "oauth client authorizations",

+			user: "bob",

+			objects: []runtime.Object{

+				&oauthapi.OAuthClientAuthorization{

+					ObjectMeta: kapi.ObjectMeta{Name: "other-user"},

+					UserName:   "alice",

+					UserUID:    "123",

+				},

+				&oauthapi.OAuthClientAuthorization{

+					ObjectMeta: kapi.ObjectMeta{Name: "bob-authorization-1"},

+					UserName:   "bob",

+					UserUID:    "234",

+				},

+				&oauthapi.OAuthClientAuthorization{

+					ObjectMeta: kapi.ObjectMeta{Name: "bob-authorization-2"},

+					UserName:   "bob",

+					UserUID:    "345",

+				},

+			},

+			expected: []interface{}{

+				ktestclient.DeleteActionImpl{ActionImpl: ktestclient.ActionImpl{Verb: "delete", Resource: "oauthclientauthorizations"}, Name: "bob-authorization-1"},

+				ktestclient.DeleteActionImpl{ActionImpl: ktestclient.ActionImpl{Verb: "delete", Resource: "oauthclientauthorizations"}, Name: "bob-authorization-2"},

+				ktestclient.DeleteActionImpl{ActionImpl: ktestclient.ActionImpl{Verb: "delete", Resource: "users"}, Name: "bob"},

+			},

+		},

 	}

 	for _, test := range tests {

@@ -190,7 +217,7 @@ func TestUserReaper(t *testing.T) {

 		ktc.PrependReactor("update", "*", reactor)

 		ktc.PrependReactor("delete", "*", reactor)

-		reaper := NewUserReaper(tc, tc, tc, tc, ktc)

+		reaper := NewUserReaper(tc, tc, tc, tc, tc, ktc)

 		err := reaper.Stop("", test.user, 0, nil)

 		if err != nil {

 			t.Errorf("%s: unexpected error: %v", test.name, err)