I’ve disabled debugging by now and the logs have expired. It was pretty plain that the group claim was included in the JSON in the log. It was like the snippet I posted originally just with a lot more content (since this was the minimal claim I originally got):