An RBAC mapper reads the IdP claim and drops every admin group

The identity provider is sending groups, yet the application silently ignores them because the claim shape changed during federation.