fix(okta): use ID token to expose app-level group claims to backend

Okta app-level group claims (configured via Sign On → Group claim filter)
are embedded in the ID token only — they do not appear in the access token
or the /v1/userinfo response.  Passing the ID token to the Keep API allows
the backend to read the `groups` claim directly from the JWT payload and
resolve the correct role via OKTA_*_GROUPS mappings.

Changes:
- auth.config.ts: use account.id_token instead of account.access_token for
  Okta; refresh flow also returns the new id_token; remove non-standard
  `groups` scope from the authorization request
- okta_authverifier.py: skip userinfo call when `groups` is already present
  in the JWT (ID tokens cannot be used as bearer for the userinfo endpoint);
  downgrade userinfo log to debug to reduce PII exposure

Author: an0nym21

keep-ui/auth.config.ts

@@ -106,9 +106,14 @@ async function refreshAccessToken(token: any) {
       );
     }
 
+    // For Okta, prefer id_token so the backend can read app-level claims (groups).
+    const newAccessToken =
+      authType === AuthType.OKTA
+        ? (refreshedTokens.id_token ?? refreshedTokens.access_token)
+        : refreshedTokens.access_token;
     return {
       ...token,
-      accessToken: refreshedTokens.access_token,
+      accessToken: newAccessToken,
       accessTokenExpires: Date.now() + (refreshedTokens.expires_in || 3600) * 1000,
       refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,
     };
@@ -258,7 +263,6 @@ const baseProviderConfigs = {
       clientId: process.env.OKTA_CLIENT_ID!,
       clientSecret: process.env.OKTA_CLIENT_SECRET!,
       issuer: process.env.OKTA_ISSUER!,
-      authorization: { params: { scope: "openid email profile groups" } },
     }),
   ],
   [AuthType.ONELOGIN]: [
@@ -363,7 +367,10 @@ export const config = {
           accessToken = account.access_token;
         } else if (authType === AuthType.OKTA) {
           tenantId = (profile as any).keep_tenant_id || "keep";
-          accessToken = account.access_token;
+          // Use the ID token so the backend can see app-level claims (e.g. groups).
+          // App-level Okta group claims are embedded in the ID token only, not the
+          // access token or userinfo response.
+          accessToken = account.id_token ?? account.access_token;
           // Explicit claim takes priority
           role = (profile as any).keep_role || (profile as any).role;
           // If no explicit claim, resolve from groups via OKTA_*_GROUPS mappings

keep/identitymanager/identity_managers/okta/okta_authverifier.py

@@ -82,7 +82,9 @@ def _get_userinfo(self, token: str) -> dict:
                 timeout=5,
             )
             if resp.status_code == 200:
-                return resp.json()
+                data = resp.json()
+                logger.debug(f"Userinfo response keys: {list(data.keys())}")
+                return data
             logger.warning(f"Userinfo endpoint returned {resp.status_code}")
         except Exception:
             logger.exception("Failed to call userinfo endpoint")
@@ -106,8 +108,14 @@ def _verify_bearer_token(self, token: str = Depends(oauth2_scheme)) -> Authentic
                 options={"verify_exp": True}
             )
 
-            # Enrich with userinfo claims (groups, name, etc. may not be in the access token)
-            userinfo = self._get_userinfo(token)
+            # Only call userinfo when the groups claim is absent from the token.
+            # When the frontend sends the Okta ID token (which carries app-level
+            # group claims directly), calling userinfo with it would return 401
+            # because the userinfo endpoint expects an access token, not an ID token.
+            if "groups" not in payload:
+                userinfo = self._get_userinfo(token)
+            else:
+                userinfo = {}
 
             tenant_id = payload.get("keep_tenant_id", "keep")
             email = (
@@ -121,7 +129,7 @@ def _verify_bearer_token(self, token: str = Depends(oauth2_scheme)) -> Authentic
             )
             groups = userinfo.get("groups", []) or payload.get("groups", [])
 
-            logger.info(f"Token claims — email={email}, name={name}, groups={groups}, group_mappings={self.group_mappings}")
+            logger.info(f"Token claims — email={email}, groups={groups}, group_mappings={self.group_mappings}")
 
             # Explicit claim overrides always take priority
             role_name = payload.get("keep_role") or payload.get("role")