OpenID Connect Cognito group scope configuration (OIDC)

[LeonBowers2]

Hi,

We’ve enabled OpenID Connect (OIDC) logins in AGOL and can successfully authenticate users and create accounts with the scopes below:

We want to enable AGOL group membership based upon OIDC groups but can’t get the scopes correct. This is what is being returned from Cognito for a test user:

       "groups": [
           "corporate_user",
           "projects_user-aswa"
       ],

When updating the provider scopes to include groups, our login using OIDC breaks.

Results in:

I’ve tried many different values for the scope including groups[] and variations of it, but can’t get it correct.

Any idea what the scope syntax in AGOL should be or should we change the groups JSON format in Cognito to something different?

Thanks,

Leon.