We are also trying to get this working (on Enterprise Portal v11.4).
In AWS, we followed the general guidance (using a lambda) to modify the access token claims so that it looks like `"groups": ["test_group"]`. See https://aws.amazon.com/blogs/mobile/how-to-use-cognito-pre-token-generators-to-customize-claims-in-i...
I wonder if there is an ESRI Blog article somewhere that has an example where this works with any OIDC IdP. What does the JWT token look like when it works? Is it using the access_token? or the id_token? What is the attribute name, and is it namespaced?
AWS doesn't allow you to use "groups" as one of its scopes. By any chance, is the portal expecting the scopes attribute in the token to include this?
We also eliminated the possibility that user permissions are an issue by testing this with a user with Administrator role.
In short, I wish this was open source so I could look at the code and answer my own questions.
Thanks for any attention!
