Hi!

Thanks a lot for this plugin! I was trying it with my OAuth IP and in my specific case the attribute (OIDC_GROUPS_ATTRIBUTE) is part of the access token and not of the user token. I made some modifications in the code to check the access token as well. Are you interested in PR? I could also add a plugin but I was thinking that this use case might be common enough to include in the main code.