Enable OIDC Group Claim in ELM/JAS for Group Membership Resolution (Independent of LDAP)

OIDC tokens are commonly used for user authentication into ELM/JAS. However, when it comes to group-based authorization and membership resolution, ELM/JAS currently often falls back to LDAP group mapping for the resolution. This approach introduces dependencies on LDAP availability and configuration. Furthermore, if the IdP providing the OIDC token has already filtered or restricted group claims due to token size limitations (as Microsoft Entra ID or Amazon Cognito allow), ELM/JAS needs a mechanism to leverage these pre-filtered claims directly. 

What is Expected:

We expect IBM ELM/JAS to enhance its OIDC integration to robustly and independently resolve user group memberships directly from the groups or similar claims within the OIDC token. This means ELM/JAS should be configurable to rely solely on the OIDC token's group claims for group membership without requiring a supplementary LDAP connection.

This enhancement directly addresses the need for ELM/JAS to manage group memberships scalably and efficiently, ensuring it trusts and correctly interprets the group claims provided by the OIDC IdP, thereby minimizing administrative overhead and reducing external system dependencies.

Benefits:

• Eliminates LDAP dependency for group memberships.
• Simplifies group management in ELM/JAS and leverages pre-filtered OIDC group claims.
• Reduces administrative overhead of external registries
• Increases scalability for large organizations.
• Supports Zero trust and claim-centric identity models.

Documentation: IBM OIDC documentation for ELM/JAS will explicitly mention this capability, providing clear guidance on how to configure ELM/JAS to leverage OIDC group claims for membership resolution, including examples of mapping claims from various IdPs that apply filtering.