update

public/page/auth_callback.php

@@ -26,6 +26,7 @@ $client = new OidcClient($config);
 $token = $client->exchangeCode($code);
 
 $idToken = (string)($token['id_token'] ?? '');
+$accessToken = (string)($token['access_token'] ?? '');
 if ($idToken === '') {
     echo '<div class="card">Kein ID Token erhalten.</div>';
     return;
@@ -36,6 +37,14 @@ $client->validateIdToken($claims, $nonce);
 unset($_SESSION['oidc_nonce']);
 
 $groups = $client->groupsFromClaims($claims);
+if (!$groups && $accessToken !== '') {
+    try {
+        $accessClaims = $client->decodeJwt($accessToken);
+        $groups = $client->groupsFromClaims($accessClaims);
+    } catch (\Throwable $e) {
+        // ignore access token decoding errors
+    }
+}
 $user = [
     'sub' => (string)($claims['sub'] ?? ''),
     'email' => (string)($claims['email'] ?? ''),