Ryan Richard 0d31e955ae Don't skip upstream group memberships when groups scope is not granted ...

Background: For dynamic clients, the groups scope is not always allowed
and/or requested by the client, so it will not always be granted by the
Supervisor for an authorization request.

Previously, when the groups scope was not granted, we would skip
searching for upstream groups in some scenarios.

This commit changes the behavior of authorization flows so that even
when the groups scope is not granted we still search for the upstream
group memberships as configured, and we pass the upstream group
memberships into any configured identity transformations. The identity
transformations could potentially reject the user's authentication based
on their upstream group membership.

When the groups scope is not granted, we don't include the groups in
the final Supervisor-issued ID token. This behavior is not changed.

2024-02-21 13:12:18 -08:00

..

transformtestutil.go

Don't skip upstream group memberships when groups scope is not granted

2024-02-21 13:12:18 -08:00