fix(oidc): apply groupsFilter to single-string groups claim

connector/oidc/oidc.go

@@ -676,9 +676,12 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
 			vs, found = claims[groupsKey].([]interface{})
 		}
 
-		// Fallback when claims[groupsKey] is a string instead of an array of strings.
+		// Fallback when claims[groupsKey] is a string instead of an array of
+		// strings. Fold it into the array path so groupsFilter (and the other
+		// per-group handling below) applies uniformly.
 		if g, b := claims[groupsKey].(string); b {
-			groups = []string{g}
+			vs = []interface{}{g}
+			found = true
 		}
 
 		if found {

connector/oidc/oidc_test.go

@@ -469,6 +469,25 @@ func TestHandleCallback(t *testing.T) {
 				"email_verified": true,
 			},
 		},
+		{
+			// A groups claim delivered as a single string must still be run
+			// through the configured groupsFilter, like the array form.
+			name:               "filterGroupClaimsString",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			groupsRegex:        `^.*\d$`,
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       nil,
+			expectedEmailField: "emailvalue",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         "groupA",
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
 		{
 			name:               "filterGroupClaimsMap",
 			userIDKey:          "", // not configured